nixos/profiles/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 with lib;
   3 {
   4   imports = [
   5     networking/nftables.nix
   6   ];
   7
   8   boot.kernel.sysctl = {
   9     # Improve MTU detection
  10     # This can thaw TCP connections stalled by a host
  11     # requiring a lower MTU along the path,
  12     # though it would do so after a little delay
  13     # so it's better to set a low MTU when possible.
  14     "net/ipv4/tcp_mtu_probing" = 1;
  15   };
  16
  17   networking = {
  18     inherit hostName;
  19     domain = mkDefault "wg";
  20     #search = [ "sourcephile.fr" ];
  21     firewall = {
  22       enable = mkDefault true;
  23       allowPing = mkDefault true;
  24     };
  25     networkmanager = {
  26       enable = mkDefault config.services.xserver.enable;
  27       #dhcp = "dhcpcd";
  28       logLevel = mkDefault "INFO";
  29       wifi = {
  30         #backend = "iwd";
  31         #backend = "wpa_supplicant";
  32         powersave = mkDefault false;
  33       };
  34     };
  35     usePredictableInterfaceNames = true;
  36   };
  37
  38   programs.mtr.enable = true;
  39   programs.traceroute.enable = mkDefault true;
  40   programs.usbtop.enable = true;
  41
  42   services.avahi = {
  43     nssmdns = mkDefault true;
  44     openFirewall = mkDefault false;
  45     publish.enable = mkDefault false;
  46   };
  47   networking.nftables.ruleset = mkIf config.services.avahi.enable (''
  48     table inet filter {
  49       chain output-lan {
  50         skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
  51       }
  52     }
  53   '' + optionalString config.services.avahi.openFirewall ''
  54     table inet filter {
  55       chain input-lan {
  56         udp dport mdns comment "avahi: multicast DNS"
  57       }
  58     }
  59   '');
  60
  61   services.openssh = {
  62     enable = mkDefault true;
  63     forwardX11 = mkDefault true;
  64     openFirewall = mkDefault false;
  65   };
  66
  67   # Fix https://github.com/NixOS/nixpkgs/issues/180175 by removing -s (aka. --wait-for-startup)
  68   systemd.services.NetworkManager-wait-online = {
  69     unitConfig.StartLimitIntervalSec = 0;
  70     serviceConfig = {
  71       ExecStart = [ "" "${pkgs.networkmanager}/bin/nm-online -q" ];
  72       Restart = "on-failure";
  73       RestartSec = 1;
  74     };
  75   };
  76   environment.etc."NetworkManager/dispatcher.d/congctl" = {
  77     mode = "700";
  78     source = pkgs.writeShellScript "congctl" ''
  79       case $NM_DISPATCHER_ACTION in
  80         up)
  81           case $DEVICE_IP_IFACE in
  82             # WLAN or WWAN
  83             # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
  84             wl*|ww*)
  85               ip route show dev $DEVICE_IP_IFACE |
  86               while read -r route; do
  87                 ip route change $route dev $DEVICE_IP_IFACE congctl westwood
  88               done
  89             ;;
  90           esac
  91         ;;
  92       esac
  93     '';
  94   };
  95 }