printing: improve setup

[julm/julm-nix.git] / hosts / aubergine / networking.nix

diff --git a/hosts/aubergine/networking.nix b/hosts/aubergine/networking.nix
index 8ba9d42a3be950720b7bfcae15f097c01608d29f..347ec3e0bd7f6a206a0543a536f359862780e3c8 100644 (file)
--- a/hosts/aubergine/networking.nix
+++ b/hosts/aubergine/networking.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ pkgs, lib, ... }:
 with lib;
 with (import networking/names-and-numbers.nix);
 {
@@ -8,18 +8,21 @@ with (import networking/names-and-numbers.nix);
     networking/wifi.nix
     networking/lte.nix
     networking/nftables.nix
-    ./wireguard.nix
     ../../nixos/profiles/dnscrypt-proxy2.nix
-    ../../nixos/profiles/wireguard/wg-intra.nix
+    ../../nixos/profiles/printing.nix
     ../../nixos/profiles/networking/ssh.nix
   ];
   install.substituteOnDestination = false;
-  networking.domain = "wg";
+  networking.domain = "sp";
   networking.useDHCP = false;
 
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
   networking.nftables.ruleset = mkAfter ''
     table inet filter {
+      chain forward-to-lan {
+        #jump forward-connectivity
+        counter accept
+      }
       chain forward-to-net {
         #jump forward-connectivity
         counter accept
@@ -34,9 +37,20 @@ with (import networking/names-and-numbers.nix);
     }
   '';
 
-  services.avahi.enable = true;
-  services.avahi.openFirewall = true;
-  services.avahi.publish.enable = true;
+  networking.networkmanager.enable = true;
+  services.avahi = {
+    enable = true;
+    openFirewall = true;
+    publish = {
+      enable = true;
+      addresses = true;
+      domain = true;
+      hinfo = true;
+      userServices = true;
+      workstation = true;
+    };
+    reflector = true;
+  };
   # WARNING: settings.listen_addresses are not merged...
   # hence there all defined here.
   services.dnscrypt-proxy2.settings.listen_addresses = [
@@ -48,9 +62,16 @@ with (import networking/names-and-numbers.nix);
     "${wifiIPv4}.1:53"
   ];
 
+  services.openssh.settings.X11Forwarding = true;
+
   services.vnstat.enable = true;
 
   systemd.services.sshd.serviceConfig.LoadCredentialEncrypted = [
     "host.key:${ssh/host.key.cred}"
   ];
+
+  programs.wireshark = {
+    enable = true;
+    package = pkgs.wireshark-cli;
+  };
 }