nixos/profiles/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 with lib;
   3 {
   4   imports = [
   5     networking/nftables.nix
   6   ];
   7
   8   boot.kernel.sysctl = {
   9     # Improve MTU detection
  10     # This can thaw TCP connections stalled by a host
  11     # requiring a lower MTU along the path,
  12     # though it would do so after a little delay
  13     # so it's better to set a low MTU when possible.
  14     "net/ipv4/tcp_mtu_probing" = 1;
  15
  16     # Use TCP BBR to significantly increase throughput
  17     # and reduce latency for connections.
  18     "net/ipv4/tcp_congestion_control" = mkDefault "bbr";
  19
  20     # BBR must be used with the fq or fq_codel qdisc with pacing enabled,
  21     # since pacing is integral to the BBR design and implementation.
  22     # BBR without pacing would not function properly,
  23     # and may incur unnecessary high packet loss rates.
  24     #
  25     # See https://github.com/systemd/systemd/issues/9725#issuecomment-412287161
  26     # See https://github.com/systemd/systemd/issues/9725#issuecomment-413796842
  27     # > The best all-round general purpose default for linux remains fq_codel.
  28     "net/core/default_qdisc" = mkDefault "fq_codel";
  29
  30     # Request Explicit Congestion Notification (ECN)
  31     # only for incoming connections (not outgoing).
  32     # See https://github.com/systemd/systemd/issues/9748#issuecomment-1261352478
  33     # > My answer to the ECN situation remains - turn it on
  34     # > - see if it works - don't inflict your decision on others.
  35     # > $ sysctl -w net.ipv4.tcp_ecn=1
  36     # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub ecn' \
  37     # >         --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
  38     # > $ sysctl -w net.ipv4.tcp_ecn=2
  39     # > $ flent -H flent-newark.bufferbloat.net -t 'now tv hub noecn' \
  40     # >         --te=download_streams=1 --socket-stats tcp_ndown # try 1,4,16
  41     # > you can then use flent-gui *.flent.gz to generate a variety of plots,
  42     # > especially comparison plots.
  43     "net/ipv4/tcp_ecn" = mkDefault 2;
  44   };
  45
  46   networking = {
  47     inherit hostName;
  48     domain = mkDefault "wg";
  49     #search = [ "sourcephile.fr" ];
  50     firewall = {
  51       enable = mkDefault true;
  52       allowPing = mkDefault true;
  53     };
  54     networkmanager = {
  55       enable = mkDefault config.services.xserver.enable;
  56       #dhcp = "dhcpcd";
  57       logLevel = mkDefault "INFO";
  58       wifi = {
  59         #backend = "iwd";
  60         #backend = "wpa_supplicant";
  61         powersave = mkDefault false;
  62       };
  63     };
  64     usePredictableInterfaceNames = true;
  65   };
  66
  67   programs.mtr.enable = true;
  68   programs.traceroute.enable = mkDefault true;
  69   programs.usbtop.enable = true;
  70
  71   services.avahi = {
  72     nssmdns = mkDefault true;
  73     openFirewall = mkDefault false;
  74     publish.enable = mkDefault false;
  75   };
  76   networking.nftables.ruleset = mkIf config.services.avahi.enable (''
  77     table inet filter {
  78       chain output-lan {
  79         skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
  80       }
  81     }
  82   '' + optionalString config.services.avahi.openFirewall ''
  83     table inet filter {
  84       chain input-lan {
  85         udp dport mdns comment "avahi: multicast DNS"
  86       }
  87     }
  88   '');
  89
  90   services.openssh.enable = mkDefault true;
  91
  92   # Fix https://github.com/NixOS/nixpkgs/issues/180175 by removing -s (aka. --wait-for-startup)
  93   systemd.services.NetworkManager-wait-online = {
  94     unitConfig.StartLimitIntervalSec = 0;
  95     serviceConfig = {
  96       ExecStart = [ "" "${pkgs.networkmanager}/bin/nm-online -q" ];
  97       Restart = "on-failure";
  98       RestartSec = 1;
  99     };
 100   };
 101   environment.etc."NetworkManager/dispatcher.d/congctl" = {
 102     mode = "700";
 103     source = pkgs.writeShellScript "congctl" ''
 104       case $NM_DISPATCHER_ACTION in
 105         up)
 106           case $DEVICE_IP_IFACE in
 107             # WLAN or WWAN
 108             # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
 109             wl*|ww*)
 110               ip route show dev $DEVICE_IP_IFACE |
 111               while read -r route; do
 112                 ip route change $route dev $DEVICE_IP_IFACE congctl westwood
 113               done
 114             ;;
 115           esac
 116         ;;
 117       esac
 118     '';
 119   };
 120
 121   # The notion of "online" is a broken concept
 122   #systemd.services.NetworkManager-wait-online.enable = false;
 123   #systemd.network.wait-online.enable = false;
 124
 125   # Do not take down the network for too long when upgrading,
 126   # This also prevents failures of services that are restarted instead of stopped.
 127   # It will use `systemctl restart` rather than stopping it with `systemctl stop`
 128   # followed by a delayed `systemctl start`.
 129   systemd.services.systemd-networkd.stopIfChanged = false;
 130
 131   # Services that are only restarted might be not able
 132   # to resolve when resolved is stopped before.
 133   systemd.services.systemd-resolved.stopIfChanged = false;
 134 }