{ pkgs, lib, ... }: { imports = [ ../../nixos/profiles/dnscrypt-proxy2.nix ../../nixos/profiles/wireguard/wg-intra.nix ../../nixos/profiles/networking/ssh.nix ../../nixos/profiles/networking/wifi.nix ./wireguard.nix networking/nftables.nix ]; install.substituteOnDestination = false; #networking.domain = "wg"; networking.useDHCP = false; networking.nftables.ruleset = lib.mkAfter '' table inet filter { chain input { goto input-net } chain output { ip daddr 10.0.0.0/8 counter goto output-lan ip daddr 172.16.0.0/12 counter goto output-lan ip daddr 192.168.0.0/16 counter goto output-lan ip daddr 224.0.0.0/3 counter goto output-lan jump output-net log level warn prefix "output-net: " counter drop } } ''; networking.interfaces = { }; networking.networkmanager = { enable = true; unmanaged = [ ]; }; services.avahi.enable = true; services.avahi.openFirewall = false; services.avahi.publish.enable = false; services.openssh.settings.X11Forwarding = true; systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [ "host.key:${ssh/host.key.cred}" ]; services.vnstat.enable = true; }