hosts/oignon/networking.nix

   1 { pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../../nixos/profiles/dnscrypt-proxy2.nix
   5     ../../nixos/profiles/networking/ssh.nix
   6     ../../nixos/profiles/networking/wifi.nix
   7     #../../nixos/profiles/openvpn/calyx.nix
   8     networking/nftables.nix
   9   ];
  10   install.substituteOnDestination = false;
  11   #networking.domain = "sourcephile.fr";
  12   networking.useDHCP = false;
  13
  14   services.tor = {
  15     # https://metrics.torproject.org/rs.html#search/flag:exit%20country:be%20running:true
  16     # https://nusenu.github.io/OrNetStats/w/relay/58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.html
  17     settings.MapAddress = [
  18       "*.redbee.live *.redbee.live.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  19       "*.rtbf.be         *.rtbf.be.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  20     ];
  21     settings.StrictNodes = true;
  22   };
  23
  24   networking.nftables.ruleset = lib.mkAfter ''
  25     table inet filter {
  26       chain input {
  27         goto input-net
  28       }
  29       chain output {
  30         ip daddr 10.0.0.0/8 counter goto output-lan
  31         ip daddr 172.16.0.0/12 counter goto output-lan
  32         ip daddr 192.168.0.0/16 counter goto output-lan
  33         ip daddr 224.0.0.0/3 counter goto output-lan
  34         jump output-net
  35         log level warn prefix "output-net: " counter drop
  36       }
  37     }
  38   '';
  39
  40   networking.hosts = {
  41     #"80.67.180.129" = ["salons.sourcephile.fr"];
  42   };
  43
  44   networking.interfaces = { };
  45
  46   networking.networkmanager = {
  47     enable = true;
  48     unmanaged = [
  49     ];
  50   };
  51   environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
  52     mode = "600";
  53     text = ''
  54       [connection]
  55       id=Prixtel
  56       uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
  57       type=gsm
  58       autoconnect=false
  59       permissions=user:julm:;
  60
  61       [gsm]
  62       apn=sl2sfr
  63       number=*99#
  64       home-only=true
  65
  66       [ppp]
  67
  68       [ipv4]
  69       method=auto
  70
  71       [ipv6]
  72       addr-gen-mode=stable-privacy
  73       method=disabled
  74
  75       [proxy]
  76     '';
  77   };
  78
  79   environment.systemPackages = [
  80     pkgs.modem-manager-gui
  81   ];
  82
  83   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  84     "host.key:${ssh/host.key.cred}"
  85   ];
  86 }