hosts/aubergine/networking.nix

   1 { lib, ... }:
   2 with lib;
   3 with (import networking/names-and-numbers.nix);
   4 {
   5   imports = [
   6     networking/ftth.nix
   7     networking/ethernet.nix
   8     networking/wifi.nix
   9     networking/lte.nix
  10     networking/nftables.nix
  11     ./wireguard.nix
  12     ../../nixos/profiles/dnscrypt-proxy2.nix
  13     ../../nixos/profiles/wireguard/wg-intra.nix
  14     ../../nixos/profiles/networking/ssh.nix
  15   ];
  16   install.substituteOnDestination = false;
  17   networking.domain = "wg";
  18   networking.useDHCP = false;
  19
  20   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  21   networking.nftables.ruleset = mkAfter ''
  22     table inet filter {
  23       chain forward-to-lan {
  24         #jump forward-connectivity
  25         counter accept
  26       }
  27       chain forward-to-net {
  28         #jump forward-connectivity
  29         counter accept
  30       }
  31       chain forward-from-net {
  32         ct state { established, related } accept
  33         log level warn prefix "forward-from-net: " counter drop
  34       }
  35       chain forward {
  36         log level warn prefix "forward: " counter drop
  37       }
  38     }
  39   '';
  40
  41   networking.networkmanager.enable = true;
  42   services.avahi.enable = true;
  43   services.avahi.openFirewall = true;
  44   services.avahi.publish.enable = true;
  45   # WARNING: settings.listen_addresses are not merged...
  46   # hence there all defined here.
  47   services.dnscrypt-proxy2.settings.listen_addresses = [
  48     "127.0.0.1:53"
  49     "[::1]:53"
  50     "${eth1IPv4}.1:53"
  51     "${eth2IPv4}.1:53"
  52     "${eth3IPv4}.1:53"
  53     "${wifiIPv4}.1:53"
  54   ];
  55
  56   services.openssh.settings.X11Forwarding = true;
  57
  58   services.vnstat.enable = true;
  59
  60   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  61     "host.key:${ssh/host.key.cred}"
  62   ];
  63 }