hosts/blackberry/networking.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   ...
   6 }:
   7 {
   8   imports = [
   9     ../../nixos/profiles/dnscrypt-proxy2.nix
  10     ../../nixos/profiles/networking/ssh.nix
  11     ../../nixos/profiles/networking/wifi.nix
  12     #../../nixos/profiles/openvpn/calyx.nix
  13     networking/nftables.nix
  14   ];
  15   install.substituteOnDestination = false;
  16   #networking.domain = "sourcephile.fr";
  17   networking.useDHCP = false;
  18
  19   services.tor = {
  20     settings = {
  21       HashedControlPassword = lib.readFile tor/HashedControlPassword.clear;
  22       # https://metrics.torproject.org/rs.html#search/flag:exit%20country:be%20running:true
  23       # https://nusenu.github.io/OrNetStats/w/relay/58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.html
  24       MapAddress = [
  25         "*.gcp.cloud.es.io *.gcp.cloud.es.io.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  26         "*.redbee.live         *.redbee.live.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  27         "*.rtbf.be                 *.rtbf.be.58B81035FC28AACA8F0E85E46C8EBAD7FCFA8404.exit"
  28       ];
  29       StrictNodes = true;
  30     };
  31   };
  32
  33   networking.nftables.ruleset = lib.mkAfter ''
  34     table inet filter {
  35       chain input {
  36         ip daddr 10.0.0.0/8 counter goto input-lan
  37         ip daddr 172.16.0.0/12 counter goto input-lan
  38         ip daddr 192.168.0.0/16 counter goto input-lan
  39         ip daddr 224.0.0.0/3 counter goto input-lan
  40         goto input-net
  41       }
  42       chain output {
  43         ip daddr 10.0.0.0/8 counter goto output-lan
  44         ip daddr 172.16.0.0/12 counter goto output-lan
  45         ip daddr 192.168.0.0/16 counter goto output-lan
  46         ip daddr 224.0.0.0/3 counter goto output-lan
  47         jump output-net
  48         log level warn prefix "output-net: " counter drop
  49       }
  50     }
  51   '';
  52
  53   networking.hosts = {
  54     #"80.67.180.129" = ["salons.sourcephile.fr"];
  55   };
  56
  57   networking.interfaces = { };
  58
  59   networking.networkmanager = {
  60     enable = true;
  61     unmanaged = [
  62     ];
  63   };
  64
  65   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
  66     "host.key:${ssh/host.key.cred}"
  67   ];
  68
  69   programs.wireshark = {
  70     enable = true;
  71     package = pkgs.wireshark-qt;
  72   };
  73 }