hosts/oignon/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/wireguard/wg-intra.nix
   6     ../../nixos/profiles/networking/ssh.nix
   7     ../../nixos/profiles/networking/wifi.nix
   8     #../../nixos/profiles/openvpn/calyx.nix
   9     networking/nftables.nix
  10   ];
  11   install.substituteOnDestination = false;
  12   #networking.domain = "sourcephile.fr";
  13   networking.useDHCP = false;
  14
  15   networking.nftables.ruleset = lib.mkAfter ''
  16     table inet filter {
  17       chain input {
  18         goto input-net
  19       }
  20       chain output {
  21         ip daddr 10.0.0.0/8 counter goto output-lan
  22         ip daddr 172.16.0.0/12 counter goto output-lan
  23         ip daddr 192.168.0.0/16 counter goto output-lan
  24         ip daddr 224.0.0.0/3 counter goto output-lan
  25         jump output-net
  26         log level warn prefix "output-net: " counter drop
  27       }
  28     }
  29   '';
  30
  31   networking.hosts = {
  32     #"80.67.180.129" = ["salons.sourcephile.fr"];
  33   };
  34
  35   networking.interfaces = { };
  36
  37   networking.networkmanager = {
  38     enable = true;
  39     unmanaged = [
  40     ];
  41   };
  42   environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
  43     mode = "600";
  44     text = ''
  45       [connection]
  46       id=Prixtel
  47       uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
  48       type=gsm
  49       autoconnect=false
  50       permissions=user:julm:;
  51
  52       [gsm]
  53       apn=sl2sfr
  54       number=*99#
  55       home-only=true
  56
  57       [ppp]
  58
  59       [ipv4]
  60       method=auto
  61
  62       [ipv6]
  63       addr-gen-mode=stable-privacy
  64       method=disabled
  65
  66       [proxy]
  67     '';
  68   };
  69
  70   environment.systemPackages = [
  71     pkgs.modem-manager-gui
  72   ];
  73
  74   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  75     "host.key:${ssh/host.key.cred}"
  76   ];
  77 }