networking options completed

.gitignore

@@ -6,3 +6,4 @@ result-*
 # Ignore automatically generated direnv output
 .direnv
 
+!.jj/

modules/networking/core/default.nix

@@ -1,38 +1,38 @@
-{ ... }:
+{ config, lib, ... }:
-
+let
+  cfg = config.homelab.networking.core;
+in
 {
-  imports = [
+  config = {
-    ./firewall.nix
+    imports = [
-  ];
+      ./firewall.nix
-
-  networking = {
-    networkmanager = {
-      enable = true;
-      dns = "systemd-resolved";
-    };
-    extraHosts = "192.168.1.60 laptop";
-    nftables.enable = true;
-
-    nameservers = [
-      "192.168.1.193" # Pi-hole
-      "1.1.1.1" # Cloudflare
-      "1.0.0.1" # Cloudflare (Secondary)
     ];
-  };
 
-  services.resolved = {
+    networking = {
-    enable = true;
+      networkmanager = {
+        enable = true;
+        dns = "systemd-resolved";
+      };
 
-    settings.Resolve = {
+      networking.extraHosts = lib.concatMapStringsSep "\n" (
-      dnssec = "true";
+        host: "${host.ip_address} ${host.hostname}"
-      DNSOverTLS = "true";
+      ) cfg.extraHosts;
-      domains = [ "~." ];
+
-      fallbackDns = [
+      nftables.enable = true;
-        "192.168.1.193" # Pi-hole
+
-        "1.1.1.1" # Cloudflare
+      nameservers = config.core.nameservers;
-        "1.0.0.1" # Cloudflare (Secondary)
-      ];
     };
 
+    services.resolved = {
+      enable = true;
+
+      settings.Resolve = {
+        dnssec = "true";
+        DNSOverTLS = "true";
+        domains = [ "~." ];
+        fallbackDns = cfg.nameservers;
+      };
+
+    };
   };
 }

modules/networking/core/firewall.nix

@@ -1,17 +1,14 @@
-{ ... }:
+{ config, ... }:
-
+let
+  cfg = config.homelab.networking.core.firewall;
+in
 {
   networking.firewall = {
     enable = true;
 
-    allowPing = true;
+    allowPing = cfg.allowPing;
 
-    allowedTCPPorts = [
+    allowedTCPPorts = cfg.ports.tcp;
-      22
+    allowedUDPPorts = cfg.ports.udp;
-      80
-    ];
-    allowedUDPPorts = [
-      53
-    ];
   };
 }

modules/networking/options.nix

@@ -1,18 +1,71 @@
 {
-  config,
   lib,
-  pkgs,
   ...
 }:
-let
-  cfg = config.homelab.networking;
-in
 {
   options.homelab.networking = {
-    enable = lib.mkOption {
+    user = lib.mkOption {
-      type = lib.types.bool;
+      type = lib.types.str;
-      default = true;
+      default = "river";
-      description = "Enable homelab networking support.";
+      description = "The user to run tailscale's services as.";
+    };
+
+    # core
+    core = {
+      firewall = {
+        allowPing = lib.mkEnableOption "Enable ICMP Pinging" {
+          enable = true;
+          default = true;
+        };
+
+        ports = {
+          tcp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [
+              22
+              80
+            ];
+          };
+          udp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [ 53 ];
+          };
+        };
+      };
+
+      extraHosts = lib.mkOption {
+        type =
+          with lib.types;
+          listOf (
+            submodule (
+              { ... }: {
+                options = {
+                  ip_address = lib.mkOption {
+                    type = str;
+                  };
+
+                  hostname = lib.mkOption {
+                    type = str;
+                  };
+                };
+              }
+            )
+          );
+
+        default = [ ];
+        description = "Additional hosts to add.";
+      };
+
+      nameservers = lib.mkOption {
+        type = with lib.types; listOf str;
+
+        default = [
+          "192.168.1.193"
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
+        description = "DNS Resolvers for System";
+      };
     };
 
     # wireguard
@@ -61,5 +114,13 @@ in
         );
       };
     };
+
+    # tailscale
+    tailscale = {
+      enable = lib.mkEnableOption "Enable Tailscale Mesh VPN" {
+        enable = true;
+        default = false;
+      };
+    };
   };
 }

modules/networking/tailscale.nix

@@ -1,25 +1,29 @@
-{ config, ... }:
+{ config, lib, ... }:
-
+let
+  cfg = config.homelab.networking.tailscale;
+in
 {
-  services.tailscale = {
+  config = lib.mkIf cfg.enable {
-    enable = true;
+    services.tailscale = {
-    openFirewall = true;
+      enable = true;
-    extraSetFlags = [ "--operator=river" ];
+      openFirewall = true;
+      extraSetFlags = [ "--operator=${cfg.user}" ];
+    };
+
+    networking.firewall = {
+      trustedInterfaces = [ config.services.tailscale.interfaceName ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+
+    systemd.services.tailscaled.serviceConfig.Environment = [
+      "TS_DEBUG_FIREWALL_MODE=nftables"
+    ];
+
+    systemd.network.wait-online.enable = false;
+    boot.initrd.systemd.network.wait-online.enable = false;
+
+    users.users.${cfg.user}.extraGroups = [
+      "tailscale"
+    ];
   };
-
-  networking.firewall = {
-    trustedInterfaces = [ config.services.tailscale.interfaceName ];
-    allowedUDPPorts = [ config.services.tailscale.port ];
-  };
-
-  systemd.services.tailscaled.serviceConfig.Environment = [
-    "TS_DEBUG_FIREWALL_MODE=nftables"
-  ];
-
-  systemd.network.wait-online.enable = false;
-  boot.initrd.systemd.network.wait-online.enable = false;
-
-  users.users.river.extraGroups = [
-    "tailscale"
-  ];
 }

modules/networking/wireguard.nix

@@ -1,22 +1,21 @@
-{ ... }:
+{ config, lib, ... }:
-
+let
+  cfg = config.homelab.networking.wireguard;
+in
 {
-  networking.wireguard.interfaces = {
+  config = lib.mkIf cfg.enable {
-    wg0 = {
+    networking.wg-quick.interfaces = lib.mapAttrs (name: iface: {
-      ips = [ "10.0.0.2/24" ];
+      address = iface.address;
-      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+      privateKeyFile = iface.privateKeyFile;
+      peers = map (p: {
+        publicKey = p.publicKey;
+        allowedIPs = p.allowedIPs;
+        endpoint = p.endpoint;
 
-      peers = [
+        persistentKeepalive = if p.persistentKeepalive != null then p.persistentKeepalive else null;
-        {
+      }) iface.peers;
-          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
+    }) (lib.filterAttrs (_: v: v.enable) cfg.interfaces);
-          allowedIPs = [ "0.0.0.0/0" ];
+
-          endpoint = "server.maariz.org:51820";
+    networking.firewall.allowedUDPPorts = [ 51820 ];
-          persistentKeepalive = 25;
-        }
-      ];
-    };
   };
-
-  # Ensure the Wireguard UDP port is open if you are hosting the server
-  networking.firewall.allowedUDPPorts = [ 51820 ];
 }