hosts/oignon/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/networking/ssh.nix
   6     ../../nixos/profiles/networking/wifi.nix
   7     #../../nixos/profiles/openvpn/calyx.nix
   8     networking/nftables.nix
   9   ];
  10   install.substituteOnDestination = false;
  11   #networking.domain = "sourcephile.fr";
  12   networking.useDHCP = false;
  13
  14   environment.systemPackages = [
  15     #pkgs.tor-ctrl # Not packaged yet
  16   ];
  17
  18   services.tor = {
  19     settings = {
  20       HashedControlPassword = lib.readFile tor/HashedControlPassword.clear;
  21       # https://metrics.torproject.org/rs.html#search/flag:exit%20country:be%20running:true
  22       # https://nusenu.github.io/OrNetStats/w/relay/58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.html
  23       MapAddress = [
  24         "*.gcp.cloud.es.io *.gcp.cloud.es.io.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  25         "*.redbee.live         *.redbee.live.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  26         "*.rtbf.be                 *.rtbf.be.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  27       ];
  28       StrictNodes = true;
  29     };
  30   };
  31
  32   networking.nftables.ruleset = lib.mkAfter ''
  33     table inet filter {
  34       chain input {
  35         goto input-net
  36       }
  37       chain output {
  38         ip daddr 10.0.0.0/8 counter goto output-lan
  39         ip daddr 172.16.0.0/12 counter goto output-lan
  40         ip daddr 192.168.0.0/16 counter goto output-lan
  41         ip daddr 224.0.0.0/3 counter goto output-lan
  42         jump output-net
  43         log level warn prefix "output-net: " counter drop
  44       }
  45     }
  46   '';
  47
  48   networking.hosts = {
  49     #"80.67.180.129" = ["salons.sourcephile.fr"];
  50   };
  51
  52   networking.interfaces = { };
  53
  54   networking.networkmanager = {
  55     enable = true;
  56     unmanaged = [
  57     ];
  58   };
  59   environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
  60     mode = "600";
  61     text = ''
  62       [connection]
  63       id=Prixtel
  64       uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
  65       type=gsm
  66       autoconnect=false
  67       permissions=user:julm:;
  68
  69       [gsm]
  70       apn=sl2sfr
  71       number=*99#
  72       home-only=true
  73
  74       [ppp]
  75
  76       [ipv4]
  77       method=auto
  78
  79       [ipv6]
  80       addr-gen-mode=stable-privacy
  81       method=disabled
  82
  83       [proxy]
  84     '';
  85   };
  86
  87   environment.systemPackages = [
  88     pkgs.modem-manager-gui
  89     #pkgs.tor-ctrl # Not packaged yet
  90   ];
  91
  92   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  93     "host.key:${ssh/host.key.cred}"
  94   ];
  95 }