Initial commit

modules/networking/core/default.nix

@@ -0,0 +1,38 @@
+{ ... }:
+
+{
+  imports = [
+    ./firewall.nix
+  ];
+
+  networking = {
+    networkmanager = {
+      enable = true;
+      dns = "systemd-resolved";
+    };
+    extraHosts = "192.168.1.60 laptop";
+    nftables.enable = true;
+
+    nameservers = [
+      "192.168.1.193" # Pi-hole
+      "1.1.1.1" # Cloudflare
+      "1.0.0.1" # Cloudflare (Secondary)
+    ];
+  };
+
+  services.resolved = {
+    enable = true;
+
+    settings.Resolve = {
+      dnssec = "true";
+      DNSOverTLS = "true";
+      domains = [ "~." ];
+      fallbackDns = [
+        "192.168.1.193" # Pi-hole
+        "1.1.1.1" # Cloudflare
+        "1.0.0.1" # Cloudflare (Secondary)
+      ];
+    };
+
+  };
+}

modules/networking/core/firewall.nix

@@ -0,0 +1,17 @@
+{ ... }:
+
+{
+  networking.firewall = {
+    enable = true;
+
+    allowPing = true;
+
+    allowedTCPPorts = [
+      22
+      80
+    ];
+    allowedUDPPorts = [
+      53
+    ];
+  };
+}

modules/networking/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  imports = [
+    ./core
+    ./tailscale.nix
+  ];
+}

modules/networking/tailscale.nix

@@ -0,0 +1,25 @@
+{ config, ... }:
+
+{
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    extraSetFlags = [ "--operator=river" ];
+  };
+
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
+  systemd.services.tailscaled.serviceConfig.Environment = [
+    "TS_DEBUG_FIREWALL_MODE=nftables"
+  ];
+
+  systemd.network.wait-online.enable = false;
+  boot.initrd.systemd.network.wait-online.enable = false;
+
+  users.users.river.extraGroups = [
+    "tailscale"
+  ];
+}

modules/networking/wireguard.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.0.0.2/24" ];
+      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+
+      peers = [
+        {
+          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "server.maariz.org:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
+  # Ensure the Wireguard UDP port is open if you are hosting the server
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+}