kevin/dotfiles
1
0
Fork 0
mirror of https://github.com/Unkn0wnCat/dotfiles.git synced 2025-06-10 12:11:37 +02:00
Code Issues Projects Releases Wiki Activity

Initial commit

Browse source
This commit is contained in:
Kevin Kandlbinder 2022-12-19 16:36:43 +01:00
commit a46d297fc7
8 changed files with 356 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

51
nixos/modules/networking.nix Normal file
View file

@ -0,0 +1,51 @@
{ lib, pkgs, config, ... }:
with lib;
let
cfg = config.kevin.networking;
in {
options.kevin.networking = {
enable = mkEnableOption "kevins networking";
avahi.enable = mkEnableOption "avahi";
firewall.wireguard = mkEnableOption "wireguard exceptions";
firewall.syncthing = mkEnableOption "syncthing exceptions";
};
config = mkIf cfg.enable (mkMerge [
(mkIf cfg.avahi.enable {
services.avahi = {
enable = true;
nssmdns = true;
publish.enable = true;
publish.domain = true;
publish.addresses = true;
publish.workstation = true;
publish.userServices = true;
};
networking.firewall.allowedUDPPorts = [ 5353 ];
})
(mkIf cfg.firewall.wireguard {
networking.firewall = {
# if packets are still dropped, they will show up in dmesg
logReversePathDrops = true;
allowedUDPPorts = [ 51820 ];
# wireguard trips rpfilter up
extraCommands = ''
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
'';
extraStopCommands = ''
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
'';
};
})
(mkIf cfg.firewall.syncthing {
networking.firewall.allowedTCPPorts = [ 22000 ];
networking.firewall.allowedUDPPorts = [ 22000 21027 ];
})
]);
}