wg-intra-peers = import wireguard/wg-intra/peers.nix;
in
{
+imports = [
+ networking/nftables.nix
+];
networking = {
hostName = hostName;
domain = lib.mkDefault "localdomain";
enable = lib.mkDefault true;
allowPing = lib.mkDefault true;
};
+ networkmanager = {
+ enable = lib.mkDefault config.services.xserver.enable;
+ #dhcp = "dhcpcd";
+ logLevel = lib.mkDefault "INFO";
+ wifi = {
+ #backend = "iwd";
+ #backend = "wpa_supplicant";
+ powersave = lib.mkDefault false;
+ };
+ };
+ usePredictableInterfaceNames = true;
};
programs.mtr.enable = true;
programs.usbtop.enable = true;
+environment.systemPackages = [
+ pkgs.iperf
+];
services.avahi = {
enable = lib.mkDefault true;
openFirewall = lib.mkDefault false;
publish.enable = lib.mkDefault false;
};
+networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
+ table inet filter {
+ chain output-lan {
+ skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
+ }
+ }
+'' + lib.optionalString config.services.avahi.openFirewall ''
+ table inet filter {
+ chain input-lan {
+ udp dport mdns comment "avahi: multicast DNS"
+ }
+ }
+'');
services.openssh = {
enable = lib.mkDefault true;
forwardX11 = lib.mkDefault true;
openFirewall = lib.mkDefault false;
+ # Enable to switch-to-configuration
+ # with the same remotely and locally
listenAddresses = [
- { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
+ { addr = "127.0.0.1"; port = 22; }
];
};
-networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable ''
- ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
-'';
-systemd.services.sshd.after = ["wireguard-wg-intra.service"];
+
+environment.etc."NetworkManager/dispatcher.d/congctl" = {
+ mode = "700";
+ source = pkgs.writeShellScript "congctl" ''
+ case $NM_DISPATCHER_ACTION in
+ up)
+ case $DEVICE_IP_IFACE in
+ # WLAN or WWAN
+ # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
+ wl*|ww*)
+ ip route show dev $DEVICE_IP_IFACE |
+ while read -r route; do
+ ip route change $route dev $DEVICE_IP_IFACE congctl westwood
+ done
+ ip r >>/tmp/log
+ ;;
+ esac
+ ;;
+ esac
+ '';
+};
}