ssh: rename { networking/ssh => ssh }

[julm/julm-nix.git] / hosts / oignon / networking.nix

diff --git a/hosts/oignon/networking.nix b/hosts/oignon/networking.nix
index 781923c6fe7f6775cac655e5ac4d573923a6745b..50d53cab0da44f44cd72c1375d64b6767e80b2ef 100644 (file)
--- a/hosts/oignon/networking.nix
+++ b/hosts/oignon/networking.nix
@@ -1,95 +1,80 @@
-{ config, pkgs, lib, hostName, ... }:
-let
-  wlan1Iface = "wlp2s0";
-  wlan2Iface = "wlp0s26u1u2";
-  wwanIface = "wwp0s29u1u4";
-  ethIface = "enp0s25";
-  wlan2IPv4 = "192.168.55";
-in
+{ pkgs, lib, ... }:
 {
-imports = [
-  ../../nixos/profiles/networking.nix
-  ../../nixos/profiles/dnscrypt-proxy2.nix
-  ../../nixos/profiles/wireguard/wg-intra.nix
-  networking/nftables.nix
-];
-install.substituteOnDestination = false;
-#networking.domain = "sourcephile.fr";
-networking.useDHCP = false;
-
-boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-networking.nftables.ruleset = ''
-  add rule inet filter input  iifname { ${wwanIface} } goto net2fw
-  add rule inet filter output oifname { ${wwanIface} } jump fw2net
-  add rule inet filter output oifname { ${wwanIface} } log level warn prefix "fw2net: " counter drop
-
-  add rule inet filter input  iifname { ${ethIface}, ${wlan1Iface}, ${wlan2Iface} } jump lan2fw
-  add rule inet filter input  iifname { ${ethIface}, ${wlan1Iface}, ${wlan2Iface} } log level warn prefix "lan2fw: " counter drop
-  add rule inet filter output oifname { ${ethIface}, ${wlan1Iface}, ${wlan2Iface} } jump fw2lan
-  add rule inet filter output oifname { ${ethIface}, ${wlan1Iface}, ${wlan2Iface} } log level warn prefix "fw2lan: " counter drop
-
-  # Forwarding
-  add rule inet filter forward iifname { ${ethIface}, ${wlan1Iface}, ${wlan2Iface} } oifname ${wwanIface} counter accept
-  add rule inet filter forward iifname ${wwanIface} oifname { ${ethIface}, ${wlan1Iface}, ${wlan2Iface} } counter accept
-
-  # Masquerading
-  add rule inet nat postrouting iifname { ${ethIface}, ${wlan1Iface}, ${wlan2Iface} } oifname ${wwanIface} masquerade
+  imports = [
+    ../../nixos/profiles/dnscrypt-proxy2.nix
+    ../../nixos/profiles/wireguard/wg-intra.nix
+    networking/nftables.nix
+  ];
+  install.substituteOnDestination = false;
+  #networking.domain = "sourcephile.fr";
+  networking.useDHCP = false;
 
-  # Wireguard wg-intra
-  add rule inet filter fw2intra tcp dport { 80, 443 } counter accept comment "HTTP"
-  add rule inet filter fw2intra tcp dport 9418 counter accept comment "Git"
-  add rule inet filter fw2intra tcp dport ssh counter accept comment "SSH"
-  add rule inet filter fw2intra udp dport 60001-60010 counter accept comment "Mosh"
-'';
+  networking.nftables.ruleset = lib.mkAfter ''
+    table inet filter {
+      chain input {
+        goto input-net
+      }
+      chain output {
+        ip daddr 10.0.0.0/8 counter goto output-lan
+        ip daddr 172.16.0.0/12 counter goto output-lan
+        ip daddr 192.168.0.0/16 counter goto output-lan
+        ip daddr 224.0.0.0/3 counter goto output-lan
+        jump output-net
+        log level warn prefix "output-net: " counter drop
+      }
+    }
+  '';
 
-networking.interfaces = {
-};
+  networking.interfaces = { };
 
-networking.networkmanager = {
-  enable = true;
-  unmanaged = [
-  ];
-};
-environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
-  mode = "600";
-  text = ''
-    [connection]
-    id=Prixtel
-    uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
-    type=gsm
-    autoconnect=false
-    permissions=user:julm:;
+  networking.networkmanager = {
+    enable = true;
+    unmanaged = [
+    ];
+  };
+  environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
+    mode = "600";
+    text = ''
+      [connection]
+      id=Prixtel
+      uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
+      type=gsm
+      autoconnect=false
+      permissions=user:julm:;
 
-    [gsm]
-    apn=sl2sfr
-    number=*99#
-    home-only=true
+      [gsm]
+      apn=sl2sfr
+      number=*99#
+      home-only=true
 
-    [ppp]
+      [ppp]
 
-    [ipv4]
-    method=auto
+      [ipv4]
+      method=auto
 
-    [ipv6]
-    addr-gen-mode=stable-privacy
-    method=disabled
+      [ipv6]
+      addr-gen-mode=stable-privacy
+      method=disabled
 
-    [proxy]
-  '';
-};
+      [proxy]
+    '';
+  };
 
-networking.wireguard.wg-intra.peers = {
-  mermet.enable = true;
-  losurdo.enable = true;
-  patate.enable = true;
-  aubergine.enable = true;
-};
+  networking.wireguard.wg-intra.peers = {
+    mermet.enable = true;
+    losurdo.enable = true;
+    patate.enable = true;
+    aubergine.enable = true;
+  };
 
-services.openssh.listenAddresses = [
-];
+  systemd.services.sshd.serviceConfig.LoadCredentialEncrypted =
+    [ "ed25519.key:${inputs.self}/host/${hostName}/networking/ssh/ed25519.key.cred" ];
+  services.openssh.hostKeys =
+    [ { type = "ed25519"; path = "/run/credentials/sshd.service/ed25519.key"; }
+    ];
 
-environment.systemPackages = [
-  pkgs.iw
-  pkgs.modem-manager-gui
-];
+  environment.systemPackages = [
+    pkgs.iw
+    pkgs.modem-manager-gui
+  ];
 }