creds: improve a bit when reinstalling

[julm/julm-nix.git] / nixos / profiles / networking.nix

diff --git a/nixos/profiles/networking.nix b/nixos/profiles/networking.nix
index 6a8a30a05a514fc7bad3ef71143aba6ff5a1bce2..0c85e20edd1e317483d48b27ae4b91cdbc48ea88 100644 (file)
--- a/nixos/profiles/networking.nix
+++ b/nixos/profiles/networking.nix
@@ -3,18 +3,35 @@ let
   wg-intra-peers = import wireguard/wg-intra/peers.nix;
 in
 {
+imports = [
+  networking/nftables.nix
+];
 networking = {
   hostName = hostName;
-  domain = lib.mkDefault "localdomain";
-  search = [ "sourcephile.fr" ];
+  domain = lib.mkDefault "wg";
+  #search = [ "sourcephile.fr" ];
   firewall = {
     enable = lib.mkDefault true;
     allowPing = lib.mkDefault true;
   };
+  networkmanager = {
+    enable = lib.mkDefault config.services.xserver.enable;
+    #dhcp = "dhcpcd";
+    logLevel = lib.mkDefault "INFO";
+    wifi = {
+      #backend = "iwd";
+      #backend = "wpa_supplicant";
+      powersave = lib.mkDefault false;
+    };
+  };
+  usePredictableInterfaceNames = true;
 };
 
 programs.mtr.enable = true;
 programs.usbtop.enable = true;
+environment.systemPackages = [
+  pkgs.iperf
+];
 
 services.avahi = {
   enable = lib.mkDefault true;
@@ -22,17 +39,49 @@ services.avahi = {
   openFirewall = lib.mkDefault false;
   publish.enable = lib.mkDefault false;
 };
+networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
+  table inet filter {
+    chain output-lan {
+      skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
+    }
+  }
+'' + lib.optionalString config.services.avahi.openFirewall ''
+  table inet filter {
+    chain input-lan {
+      udp dport mdns comment "avahi: multicast DNS"
+    }
+  }
+'');
 
 services.openssh = {
   enable = lib.mkDefault true;
   forwardX11 = lib.mkDefault true;
   openFirewall = lib.mkDefault false;
+  # Enable to switch-to-configuration
+  # with the same remotely and locally
   listenAddresses = [
-    { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
+    { addr = "127.0.0.1"; port = 22; }
   ];
 };
-networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable  ''
-  ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
-'';
-systemd.services.sshd.after = ["wireguard-wg-intra.service"];
+
+environment.etc."NetworkManager/dispatcher.d/congctl" = {
+  mode = "700";
+  source = pkgs.writeShellScript "congctl" ''
+    case $NM_DISPATCHER_ACTION in
+      up)
+        case $DEVICE_IP_IFACE in
+          # WLAN or WWAN
+          # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
+          wl*|ww*)
+            ip route show dev $DEVICE_IP_IFACE |
+            while read -r route; do
+              ip route change $route dev $DEVICE_IP_IFACE congctl westwood
+            done
+            ip r >>/tmp/log
+          ;;
+        esac
+      ;;
+    esac
+  '';
+};
 }