hosts/aubergine/networking.nix

   1 { pkgs, lib, ... }:
   2 with (import networking/names-and-numbers.nix);
   3 {
   4   imports = [
   5     networking/ftth.nix
   6     networking/ethernet.nix
   7     networking/wifi.nix
   8     networking/lte.nix
   9     networking/nftables.nix
  10     ../../nixos/profiles/dnscrypt-proxy2.nix
  11     ../../nixos/profiles/printing.nix
  12     ../../nixos/profiles/networking/ssh.nix
  13   ];
  14   install.substituteOnDestination = false;
  15   networking.domain = "sp";
  16   networking.useDHCP = false;
  17
  18   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  19   networking.nftables.ruleset = lib.mkAfter ''
  20     table inet filter {
  21       chain forward-to-lan {
  22         #jump forward-connectivity
  23         counter accept
  24       }
  25       chain forward-to-net {
  26         #jump forward-connectivity
  27         counter accept
  28       }
  29       chain forward-from-net {
  30         ct state established accept
  31         ct state related accept
  32         log level warn prefix "forward-from-net: " counter drop
  33       }
  34       chain forward {
  35         log level warn prefix "forward: " counter drop
  36       }
  37     }
  38   '';
  39
  40   networking.networkmanager.enable = true;
  41   services.avahi = {
  42     enable = true;
  43     openFirewall = true;
  44     publish = {
  45       enable = true;
  46       addresses = true;
  47       domain = true;
  48       hinfo = true;
  49       userServices = true;
  50       workstation = true;
  51     };
  52     reflector = true;
  53   };
  54   # WARNING: settings.listen_addresses are not merged...
  55   # hence there all defined here.
  56   services.dnscrypt-proxy2.settings.listen_addresses = [
  57     "127.0.0.1:53"
  58     "[::1]:53"
  59     "${eth1IPv4}.1:53"
  60     "${eth2IPv4}.1:53"
  61     "${eth3IPv4}.1:53"
  62     "${wifiIPv4}.1:53"
  63   ];
  64
  65   services.openssh.settings.X11Forwarding = true;
  66
  67   services.vnstat.enable = true;
  68
  69   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  70     "host.key:${ssh/host.key.cred}"
  71   ];
  72
  73   programs.wireshark = {
  74     enable = true;
  75     package = pkgs.wireshark-cli;
  76   };
  77 }