hosts/blackberry/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/networking/ssh.nix
   6     ../../nixos/profiles/networking/wifi.nix
   7     #../../nixos/profiles/openvpn/calyx.nix
   8     networking/nftables.nix
   9   ];
  10   install.substituteOnDestination = false;
  11   #networking.domain = "sourcephile.fr";
  12   networking.useDHCP = false;
  13
  14   services.tor = {
  15     settings = {
  16       HashedControlPassword = lib.readFile tor/HashedControlPassword.clear;
  17       # https://metrics.torproject.org/rs.html#search/flag:exit%20country:be%20running:true
  18       # https://nusenu.github.io/OrNetStats/w/relay/58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.html
  19       MapAddress = [
  20         "*.gcp.cloud.es.io *.gcp.cloud.es.io.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  21         "*.redbee.live         *.redbee.live.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  22         "*.rtbf.be                 *.rtbf.be.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  23       ];
  24       StrictNodes = true;
  25     };
  26   };
  27
  28   networking.nftables.ruleset = lib.mkAfter ''
  29     table inet filter {
  30       chain input {
  31         goto input-net
  32       }
  33       chain output {
  34         ip daddr 10.0.0.0/8 counter goto output-lan
  35         ip daddr 172.16.0.0/12 counter goto output-lan
  36         ip daddr 192.168.0.0/16 counter goto output-lan
  37         ip daddr 224.0.0.0/3 counter goto output-lan
  38         jump output-net
  39         log level warn prefix "output-net: " counter drop
  40       }
  41     }
  42   '';
  43
  44   networking.hosts = {
  45     #"80.67.180.129" = ["salons.sourcephile.fr"];
  46   };
  47
  48   networking.interfaces = { };
  49
  50   networking.networkmanager = {
  51     enable = true;
  52     unmanaged = [
  53     ];
  54   };
  55
  56   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  57     "host.key:${ssh/host.key.cred}"
  58   ];
  59 }