0xa/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

shuffle around networking modules

Browse source
This commit is contained in:
Grigory Shipunov 2023-05-28 23:37:31 +02:00
parent 28aedace6e
commit e232e7c0ec
Signed by: 0xa
GPG key ID: 91FA5E5BF9AA901C
3 changed files with 77 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
hosts/toaster/default.nix
View file

@ -4,7 +4,7 @@
./amdgpu-sg-fix.nix ./amdgpu-sg-fix.nix
./hardware-configuration.nix ./hardware-configuration.nix
./irc.nix ./irc.nix
./network.nix ./stateful-network.nix
./secrets.nix ./secrets.nix
./secure-boot.nix ./secure-boot.nix
./zfs.nix ./zfs.nix

56
hosts/toaster/network.nix
View file

@ -1,10 +1,13 @@
{ pkgs, ... }: { { config, pkgs, ... }: {
users.users.grue.extraGroups = [ "networkmanager" ]; environment.systemPackages = with pkgs; [ iwgtk ];
networking = { networking = {
hostName = "toaster"; hostName = "toaster";
firewall.enable = true; firewall.enable = true;
networkmanager.enable = false;
useNetworkd = true;
wireguard.enable = true; wireguard.enable = true;
wireless.iwd.enable = true;
}; };
services.resolved = { services.resolved = {
@ -18,22 +21,37 @@
]; ];
}; };
# fixup the rpfilter fucking up the networkmanager wireguard # workaround for networkd waiting for shit
networking.firewall = { systemd.services.systemd-networkd-wait-online.serviceConfig.ExecStart = [
# if packets are still dropped, they will show up in dmesg "" # clear old command
logReversePathDrops = true; "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online --any"
# wireguard trips rpfilter up ];
extraCommands = ''
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN systemd.network = {
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN enable = true;
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN networks."10-ether" = {
''; matchConfig.MACAddress = "e8:80:88:2f:c6:70";
extraStopCommands = '' networkConfig = {
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true DHCP = "yes";
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true IPv6AcceptRA = true;
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN || true };
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN || true };
''; networks."10-dock" = {
matchConfig.Name = "enp5s0f4u1u1";
networkConfig = {
DHCP = "yes";
IPv6AcceptRA = true;
};
dhcpV4Config = { RouteMetric = 666; };
};
networks."10-wlan" = {
# matchConfig.MACAddress = "04:7b:cb:2a:aa:8c";
matchConfig.Name = "wlan0";
networkConfig = {
DHCP = "yes";
IPv6AcceptRA = true;
};
};
}; };
} }

39
hosts/toaster/stateful-network.nix Normal file
View file

@ -0,0 +1,39 @@
{ pkgs, ... }: {
users.users.grue.extraGroups = [ "networkmanager" ];
networking = {
hostName = "toaster";
firewall.enable = true;
wireguard.enable = true;
};
services.resolved = {
enable = true;
dnssec = "allow-downgrade";
fallbackDns = [
"9.9.9.9"
"2620:fe::fe"
"149.112.112.112"
"2620:fe::9"
];
};
# fixup the rpfilter fucking up the networkmanager wireguard
networking.firewall = {
# if packets are still dropped, they will show up in dmesg
logReversePathDrops = true;
# wireguard trips rpfilter up
extraCommands = ''
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN
'';
extraStopCommands = ''
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN || true
'';
};
}