]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/courge/networking.nix
mpv: fix dynaudnorm
[julm/julm-nix.git] / hosts / courge / networking.nix
1 { pkgs, lib, ... }:
2 {
3 imports = [
4 ../../nixos/profiles/dnscrypt-proxy2.nix
5 ../../nixos/profiles/wireguard/wg-intra.nix
6 ../../nixos/profiles/networking/remote.nix
7 ./wireguard.nix
8 networking/nftables.nix
9 ];
10 install.substituteOnDestination = true;
11
12 networking.nftables.ruleset = lib.mkAfter ''
13 table inet filter {
14 chain input {
15 ip daddr 10.0.0.0/8 counter goto input-lan
16 ip daddr 172.16.0.0/12 counter goto input-lan
17 ip daddr 192.168.0.0/16 counter goto input-lan
18 ip daddr 224.0.0.0/3 counter goto input-lan
19 goto input-net
20 }
21 chain output {
22 ip daddr 10.0.0.0/8 counter goto output-lan
23 ip daddr 172.16.0.0/12 counter goto output-lan
24 ip daddr 192.168.0.0/16 counter goto output-lan
25 ip daddr 224.0.0.0/3 counter goto output-lan
26 jump output-net
27 log level warn prefix "output-net: " counter drop
28 }
29 }
30 '';
31
32 networking.networkmanager.enable = true;
33 services.avahi.enable = true;
34 services.openssh.settings.X11Forwarding = true;
35 services.vnstat.enable = true;
36 systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
37 "host.key:${ssh/host.key.cred}"
38 ];
39 }