]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/aubergine/networking.nix
wireguard: avoid restart by not using inputs.self
[julm/julm-nix.git] / hosts / aubergine / networking.nix
1 { lib, ... }:
2 with lib;
3 with (import networking/names-and-numbers.nix);
4 {
5 imports = [
6 networking/ftth.nix
7 networking/ethernet.nix
8 networking/wifi.nix
9 networking/lte.nix
10 networking/nftables.nix
11 ./wireguard.nix
12 ../../nixos/profiles/dnscrypt-proxy2.nix
13 ../../nixos/profiles/wireguard/wg-intra.nix
14 ../../nixos/profiles/networking/ssh.nix
15 ];
16 install.substituteOnDestination = false;
17 networking.domain = "wg";
18 networking.useDHCP = false;
19
20 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
21 networking.nftables.ruleset = mkAfter ''
22 table inet filter {
23 chain forward-to-net {
24 #jump forward-connectivity
25 counter accept
26 }
27 chain forward-from-net {
28 ct state { established, related } accept
29 log level warn prefix "forward-from-net: " counter drop
30 }
31 chain forward {
32 log level warn prefix "forward: " counter drop
33 }
34 }
35 '';
36
37 services.avahi.enable = true;
38 services.avahi.openFirewall = true;
39 services.avahi.publish.enable = true;
40 # WARNING: settings.listen_addresses are not merged...
41 # hence there all defined here.
42 services.dnscrypt-proxy2.settings.listen_addresses = [
43 "127.0.0.1:53"
44 "[::1]:53"
45 "${eth1IPv4}.1:53"
46 "${eth2IPv4}.1:53"
47 "${eth3IPv4}.1:53"
48 "${wifiIPv4}.1:53"
49 ];
50
51 services.vnstat.enable = true;
52 }