networking options completed

.gitignore

@@ -6,3 +6,4 @@ result-*
 # Ignore automatically generated direnv output
 .direnv
 
+!.jj/

modules/networking/core/default.nix

@@ -1,6 +1,9 @@
-{ ... }:
+{ config, lib, ... }:
-
+let
+  cfg = config.homelab.networking.core;
+in
 {
+  config = {
     imports = [
       ./firewall.nix
     ];
@@ -10,14 +13,14 @@
         enable = true;
         dns = "systemd-resolved";
       };
-    extraHosts = "192.168.1.60 laptop";
+
+      networking.extraHosts = lib.concatMapStringsSep "\n" (
+        host: "${host.ip_address} ${host.hostname}"
+      ) cfg.extraHosts;
+
       nftables.enable = true;
 
-    nameservers = [
+      nameservers = config.core.nameservers;
-      "192.168.1.193" # Pi-hole
-      "1.1.1.1" # Cloudflare
-      "1.0.0.1" # Cloudflare (Secondary)
-    ];
     };
 
     services.resolved = {
@@ -27,12 +30,9 @@
         dnssec = "true";
         DNSOverTLS = "true";
         domains = [ "~." ];
-      fallbackDns = [
+        fallbackDns = cfg.nameservers;
-        "192.168.1.193" # Pi-hole
-        "1.1.1.1" # Cloudflare
-        "1.0.0.1" # Cloudflare (Secondary)
-      ];
       };
 
     };
+  };
 }

modules/networking/core/firewall.nix

@@ -1,17 +1,14 @@
-{ ... }:
+{ config, ... }:
-
+let
+  cfg = config.homelab.networking.core.firewall;
+in
 {
   networking.firewall = {
     enable = true;
 
-    allowPing = true;
+    allowPing = cfg.allowPing;
 
-    allowedTCPPorts = [
+    allowedTCPPorts = cfg.ports.tcp;
-      22
+    allowedUDPPorts = cfg.ports.udp;
-      80
-    ];
-    allowedUDPPorts = [
-      53
-    ];
   };
 }

modules/networking/options.nix

@@ -1,18 +1,71 @@
 {
-  config,
   lib,
-  pkgs,
   ...
 }:
-let
-  cfg = config.homelab.networking;
-in
 {
   options.homelab.networking = {
-    enable = lib.mkOption {
+    user = lib.mkOption {
-      type = lib.types.bool;
+      type = lib.types.str;
+      default = "river";
+      description = "The user to run tailscale's services as.";
+    };
+
+    # core
+    core = {
+      firewall = {
+        allowPing = lib.mkEnableOption "Enable ICMP Pinging" {
+          enable = true;
           default = true;
-      description = "Enable homelab networking support.";
+        };
+
+        ports = {
+          tcp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [
+              22
+              80
+            ];
+          };
+          udp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [ 53 ];
+          };
+        };
+      };
+
+      extraHosts = lib.mkOption {
+        type =
+          with lib.types;
+          listOf (
+            submodule (
+              { ... }: {
+                options = {
+                  ip_address = lib.mkOption {
+                    type = str;
+                  };
+
+                  hostname = lib.mkOption {
+                    type = str;
+                  };
+                };
+              }
+            )
+          );
+
+        default = [ ];
+        description = "Additional hosts to add.";
+      };
+
+      nameservers = lib.mkOption {
+        type = with lib.types; listOf str;
+
+        default = [
+          "192.168.1.193"
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
+        description = "DNS Resolvers for System";
+      };
     };
 
     # wireguard
@@ -61,5 +114,13 @@ in
         );
       };
     };
+
+    # tailscale
+    tailscale = {
+      enable = lib.mkEnableOption "Enable Tailscale Mesh VPN" {
+        enable = true;
+        default = false;
+      };
+    };
   };
 }

modules/networking/tailscale.nix

@@ -1,10 +1,13 @@
-{ config, ... }:
+{ config, lib, ... }:
-
+let
+  cfg = config.homelab.networking.tailscale;
+in
 {
+  config = lib.mkIf cfg.enable {
     services.tailscale = {
       enable = true;
       openFirewall = true;
-    extraSetFlags = [ "--operator=river" ];
+      extraSetFlags = [ "--operator=${cfg.user}" ];
     };
 
     networking.firewall = {
@@ -19,7 +22,8 @@
     systemd.network.wait-online.enable = false;
     boot.initrd.systemd.network.wait-online.enable = false;
 
-  users.users.river.extraGroups = [
+    users.users.${cfg.user}.extraGroups = [
       "tailscale"
     ];
+  };
 }

modules/networking/wireguard.nix

@@ -1,22 +1,21 @@
-{ ... }:
+{ config, lib, ... }:
-
+let
+  cfg = config.homelab.networking.wireguard;
+in
 {
-  networking.wireguard.interfaces = {
+  config = lib.mkIf cfg.enable {
-    wg0 = {
+    networking.wg-quick.interfaces = lib.mapAttrs (name: iface: {
-      ips = [ "10.0.0.2/24" ];
+      address = iface.address;
-      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+      privateKeyFile = iface.privateKeyFile;
+      peers = map (p: {
+        publicKey = p.publicKey;
+        allowedIPs = p.allowedIPs;
+        endpoint = p.endpoint;
 
-      peers = [
+        persistentKeepalive = if p.persistentKeepalive != null then p.persistentKeepalive else null;
-        {
+      }) iface.peers;
-          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
+    }) (lib.filterAttrs (_: v: v.enable) cfg.interfaces);
-          allowedIPs = [ "0.0.0.0/0" ];
-          endpoint = "server.maariz.org:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
 
-  # Ensure the Wireguard UDP port is open if you are hosting the server
     networking.firewall.allowedUDPPorts = [ 51820 ];
+  };
 }