hosts/aubergine/networking.nix

   1 { lib, ... }:
   2 with lib;
   3 with (import networking/names-and-numbers.nix);
   4 {
   5   imports = [
   6     networking/ftth.nix
   7     networking/ethernet.nix
   8     networking/wifi.nix
   9     networking/lte.nix
  10     networking/nftables.nix
  11     ./wireguard.nix
  12     ../../nixos/profiles/dnscrypt-proxy2.nix
  13     ../../nixos/profiles/wireguard/wg-intra.nix
  14     ../../nixos/profiles/networking/ssh.nix
  15   ];
  16   install.substituteOnDestination = false;
  17   networking.domain = "wg";
  18   networking.useDHCP = false;
  19
  20   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  21   networking.nftables.ruleset = mkAfter ''
  22     table inet filter {
  23       chain forward-to-net {
  24         #jump forward-connectivity
  25         counter accept
  26       }
  27       chain forward-from-net {
  28         ct state { established, related } accept
  29         log level warn prefix "forward-from-net: " counter drop
  30       }
  31       chain forward {
  32         log level warn prefix "forward: " counter drop
  33       }
  34     }
  35   '';
  36
  37   services.avahi.enable = true;
  38   services.avahi.openFirewall = true;
  39   services.avahi.publish.enable = true;
  40   # WARNING: settings.listen_addresses are not merged...
  41   # hence there all defined here.
  42   services.dnscrypt-proxy2.settings.listen_addresses = [
  43     "127.0.0.1:53"
  44     "[::1]:53"
  45     "${eth1IPv4}.1:53"
  46     "${eth2IPv4}.1:53"
  47     "${eth3IPv4}.1:53"
  48     "${wifiIPv4}.1:53"
  49   ];
  50
  51   services.vnstat.enable = true;
  52
  53   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  54     "host.key:${ssh/host.key.cred}"
  55   ];
  56 }