hosts/aubergine/networking.nix

   1 { lib, ... }:
   2 with (import networking/names-and-numbers.nix);
   3 {
   4   imports = [
   5     networking/ftth.nix
   6     networking/ethernet.nix
   7     networking/wifi.nix
   8     networking/lte.nix
   9     networking/nftables.nix
  10     ../../nixos/profiles/networking.nix
  11     ../../nixos/profiles/dnscrypt-proxy2.nix
  12     ../../nixos/profiles/wireguard/wg-intra.nix
  13   ];
  14   install.substituteOnDestination = false;
  15   networking.domain = "wg";
  16   networking.useDHCP = false;
  17
  18   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  19   networking.nftables.ruleset = lib.mkAfter ''
  20     table inet filter {
  21       chain forward-to-net {
  22         #jump forward-connectivity
  23         counter accept
  24       }
  25       chain forward-from-net {
  26         ct state { established, related } accept
  27         log level warn prefix "forward-from-net: " counter drop
  28       }
  29       chain forward {
  30         log level warn prefix "forward: " counter drop
  31       }
  32     }
  33   '';
  34
  35   services.avahi.openFirewall = true;
  36   services.dnscrypt-proxy2.settings.listen_addresses = [
  37     "127.0.0.1:53"
  38     "[::1]:53"
  39   ];
  40
  41   networking.wireguard.wg-intra.peers = {
  42     mermet.enable = true;
  43     losurdo.enable = true;
  44     oignon.enable = true;
  45     patate.enable = true;
  46   };
  47
  48 }