{ config, pkgs, lib, hostName, ... }: let wg-intra-peers = import wireguard/wg-intra/peers.nix; in { imports = [ networking/nftables.nix ]; networking = { hostName = hostName; domain = lib.mkDefault "wg"; #search = [ "sourcephile.fr" ]; firewall = { enable = lib.mkDefault true; allowPing = lib.mkDefault true; }; networkmanager = { enable = lib.mkDefault config.services.xserver.enable; #dhcp = "dhcpcd"; logLevel = lib.mkDefault "INFO"; wifi = { #backend = "iwd"; #backend = "wpa_supplicant"; powersave = lib.mkDefault false; }; }; usePredictableInterfaceNames = true; }; programs.mtr.enable = true; programs.usbtop.enable = true; environment.systemPackages = [ pkgs.iperf ]; services.avahi = { enable = lib.mkDefault true; nssmdns = lib.mkDefault true; openFirewall = lib.mkDefault false; publish.enable = lib.mkDefault false; }; networking.nftables.ruleset = lib.mkIf config.services.avahi.enable ('' table inet filter { chain output-lan { skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS" } } '' + lib.optionalString config.services.avahi.openFirewall '' table inet filter { chain input-lan { udp dport mdns comment "avahi: multicast DNS" } } ''); services.openssh = { enable = lib.mkDefault true; forwardX11 = lib.mkDefault true; openFirewall = lib.mkDefault false; # Enable to switch-to-configuration # with the same remotely and locally listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ]; }; environment.etc."NetworkManager/dispatcher.d/congctl" = { mode = "700"; source = pkgs.writeShellScript "congctl" '' case $NM_DISPATCHER_ACTION in up) case $DEVICE_IP_IFACE in # WLAN or WWAN # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+ wl*|ww*) ip route show dev $DEVICE_IP_IFACE | while read -r route; do ip route change $route dev $DEVICE_IP_IFACE congctl westwood done ip r >>/tmp/log ;; esac ;; esac ''; }; }