hosts/courge/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/wireguard/wg-intra.nix
   6     ../../nixos/profiles/networking/ssh.nix
   7     ../../nixos/profiles/networking/wifi.nix
   8     ../../nixos/profiles/openvpn/calyx.nix
   9     ./wireguard.nix
  10     networking/nftables.nix
  11   ];
  12   install.substituteOnDestination = false;
  13   #networking.domain = "sourcephile.fr";
  14   networking.useDHCP = false;
  15
  16   networking.nftables.ruleset = lib.mkAfter ''
  17     table inet filter {
  18       chain input {
  19         goto input-net
  20       }
  21       chain output {
  22         ip daddr 10.0.0.0/8 counter goto output-lan
  23         ip daddr 172.16.0.0/12 counter goto output-lan
  24         ip daddr 192.168.0.0/16 counter goto output-lan
  25         ip daddr 224.0.0.0/3 counter goto output-lan
  26         jump output-net
  27         log level warn prefix "output-net: " counter drop
  28       }
  29     }
  30   '';
  31
  32   networking.hosts = {
  33     #"80.67.180.129" = ["salons.sourcephile.fr"];
  34   };
  35
  36   networking.interfaces = { };
  37
  38   networking.networkmanager = {
  39     enable = true;
  40     unmanaged = [
  41     ];
  42   };
  43   environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
  44     mode = "600";
  45     text = ''
  46       [connection]
  47       id=Prixtel
  48       uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
  49       type=gsm
  50       autoconnect=false
  51       permissions=user:julm:;
  52
  53       [gsm]
  54       apn=sl2sfr
  55       number=*99#
  56       home-only=true
  57
  58       [ppp]
  59
  60       [ipv4]
  61       method=auto
  62
  63       [ipv6]
  64       addr-gen-mode=stable-privacy
  65       method=disabled
  66
  67       [proxy]
  68     '';
  69   };
  70
  71   environment.systemPackages = [
  72     pkgs.iw
  73     pkgs.modem-manager-gui
  74   ];
  75
  76   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  77     "host.key:${ssh/host.key.cred}"
  78   ];
  79 }