Add DoT, networkd

Signed-off-by: Ivan Bushchik <ivabus@ivabus.dev>
This commit is contained in:
Ivan Bushchik 2023-08-23 10:36:32 +03:00
parent 86b8eed465
commit f9d23bbb12
No known key found for this signature in database
GPG key ID: 9F6DDABE11A2674D
11 changed files with 45 additions and 18 deletions

View file

@ -8,6 +8,7 @@ in {
}; };
config = lib.mkIf (cfg.enable) { config = lib.mkIf (cfg.enable) {
networking.wireless.iwd.enable = true;
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
lm_sensors lm_sensors
]; ];

View file

@ -1,20 +1,27 @@
{ pkgs, ... }: { pkgs, lib, ... }:
{ {
networking.wireless.iwd.enable = true; networking.firewall.allowPing = true;
networking.wireless.iwd.settings = { networking.useNetworkd = lib.mkDefault true;
General = { systemd.network.wait-online.enable = lib.mkDefault false;
# Enable DHCP in IWD, TODO: don't do it
EnableNetworkConfiguration = true; # Use systemd-resolved for DoT support.
}; services.resolved = {
enable = true;
dnssec = "false";
extraConfig = ''
DNSOverTLS=yes
'';
}; };
# TODO: setup DoH or DoT # Used by systemd-resolved, not directly by resolv.conf.
networking.nameservers = [ "1.1.1.1" "1.0.0.1" "8.8.8.8" ]; networking.nameservers = [
"8.8.8.8#dns.google"
"1.0.0.1#cloudflare-dns.com"
];
networking.enableIPv6 = true; networking.enableIPv6 = true;
services.resolved.enable = true;
services.avahi = { services.avahi = {
enable = true; enable = true;
nssmdns = true; nssmdns = true;

View file

@ -18,7 +18,9 @@
boot.kernel.sysctl = { boot.kernel.sysctl = {
"kernel.sysrq" = 0; "kernel.sysrq" = 0;
"net.ipv4.icmp_ignore_bogus_error_responces" = 1; "net.ipv4.icmp_ignore_bogus_error_responces" = 1;
"net.ipv4.icmp_echo_ignore_broadcasts" = 1;
"net.ipv4.conf.default.rp_filter" = 1; "net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.conf.all.rp_filter" = 1; "net.ipv4.conf.all.rp_filter" = 1;
"net.ipv4.conf.all.accept_source_route" = 0; "net.ipv4.conf.all.accept_source_route" = 0;
@ -33,12 +35,18 @@
"net.ipv4.conf.default.secure_redirects" = 0; "net.ipv4.conf.default.secure_redirects" = 0;
"net.ipv6.conf.all.accept_redirects" = 0; "net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0; "net.ipv6.conf.default.accept_redirects" = 0;
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.accept_ra" = 0;
"net.ipv6.conf.default.accept_ra" = 0;
"net.ipv4.tcp_syncookies" = 1; "net.ipv4.tcp_syncookies" = 1;
"net.ipv4.conf.default.log_martians" = 1;
"net.ipv4.conf.all.log_martians" = 1;
"net.ipv4.tcp_rfc1337" = 1; "net.ipv4.tcp_rfc1337" = 1;
"net.ipv4.tcp_fastopen" = 3; "net.ipv4.tcp_fastopen" = 3;
"net.ipv4.tcp_congestion_control" = "bbr"; "net.ipv4.tcp_congestion_control" = "bbr";
"net.core.default_qdisc" = "cake"; "net.core.default_qdisc" = "cake";
}; };

View file

@ -26,6 +26,9 @@ in {
yggdrasil-client.enable = true; yggdrasil-client.enable = true;
}; };
networking.useDHCP = true;
# Setup asahi-specific things. NOTE: you must copy firmware from ESP to /etc/nixos/asahi/firmware # Setup asahi-specific things. NOTE: you must copy firmware from ESP to /etc/nixos/asahi/firmware
hardware.asahi.peripheralFirmwareDirectory = ../../asahi/firmware; hardware.asahi.peripheralFirmwareDirectory = ../../asahi/firmware;
hardware.asahi.addEdgeKernelConfig = true; hardware.asahi.addEdgeKernelConfig = true;

View file

@ -25,7 +25,6 @@
swapDevices = swapDevices =
[ { device = "/dev/disk/by-uuid/272341f1-b083-497e-b129-aef8732b5b50"; } [ { device = "/dev/disk/by-uuid/272341f1-b083-497e-b129-aef8732b5b50"; }
]; ];
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux"; nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand"; powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";

View file

@ -27,6 +27,8 @@ in {
yggdrasil-client.enable = true; yggdrasil-client.enable = true;
}; };
networking.useDHCP = true;
system.stateVersion = "23.05"; system.stateVersion = "23.05";
} }

View file

@ -33,6 +33,8 @@ in {
cpuFreqGovernor = "ondemand"; cpuFreqGovernor = "ondemand";
}; };
networking.useDHCP = true;
system.stateVersion = "23.05"; system.stateVersion = "23.05";
} }

View file

@ -25,6 +25,8 @@ in {
yggdrasil-client.enable = true; yggdrasil-client.enable = true;
}; };
networking.useDHCP = true;
services.xserver.videoDrivers=["amdgpu"]; services.xserver.videoDrivers=["amdgpu"];
boot.initrd.kernelModules=["amdgpu"]; boot.initrd.kernelModules=["amdgpu"];

View file

@ -23,8 +23,6 @@
swapDevices = [ ]; swapDevices = [ ];
networking.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

View file

@ -4,7 +4,7 @@ let
cfg = config.my.roles.gaming; cfg = config.my.roles.gaming;
in { in {
options.my.roles.gaming.enable = lib.mkEnableOption "Enable wine & steam"; options.my.roles.gaming.enable = lib.mkEnableOption "Enable wine & steam";
config = lib.mkIf (cfg.enable) (lib.mkMerge { config = lib.mkIf (cfg.enable) ( lib.mkMerge [{
nixpkgs.config.allowUnfree = true; nixpkgs.config.allowUnfree = true;
hardware.opengl.driSupport32Bit = true; hardware.opengl.driSupport32Bit = true;
services.pipewire.alsa.support32Bit = true; services.pipewire.alsa.support32Bit = true;
@ -17,6 +17,11 @@ in {
wineWowPackages.waylandFull wineWowPackages.waylandFull
]; ];
} }
# Enable steam only on x86_64 (since we have hosts with ARM, but I don't think I will enable my.roles.gaming on ARM system soon) # Enable steam only on x86_64 (since I have hosts with ARM, but I don't think I will enable my.roles.gaming on ARM system soon)
(lib.mkIf(pkgs.stdenv.isx86_64) {programs.steam.enable = true;})) (lib.mkIf(pkgs.stdenv.isx86_64) {
programs.steam.enable = true; # Firewall ports used by Steam in-home streaming.
networking.firewall.allowedTCPPorts = [ 27036 27037 ];
networking.firewall.allowedUDPPorts = [ 27031 27036 ];
})
]);
} }

View file

@ -5,7 +5,7 @@ let
in { in {
options.my.roles.latex.enable = lib.mkEnableOption "Enable latex stuff"; options.my.roles.latex.enable = lib.mkEnableOption "Enable latex stuff";
config = lib.mkIf (cfg.enable){ config = lib.mkIf (cfg.enable){
environment.systemPackages = with pkgs; environment.systemPackages = with pkgs; [
# Maybe I don't need to use -full variant of texlive # Maybe I don't need to use -full variant of texlive
# I should find distribution I actually need # I should find distribution I actually need
texlive.combined.scheme-full texlive.combined.scheme-full