blob: 153b2902dc8a304861c99523bda40e0e5786f930 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
{
me,
util,
config,
lib,
pkgs,
...
}:
{
imports = [
./foundation
./nix.nix
./user.nix
./locale.nix
./tailscale.nix
./nix-ld.nix
./vim.nix
];
# fish enables this by default,
# it makes every nixos rebuild very slow.
documentation.man.generateCaches = false;
users.motd = ''
/^ /^
\ ' ' 7 < Hi, I'm ${util.titleCase me.name}
/ \
'';
networking = {
hostName = me.name;
useDHCP = false;
dhcpcd.enable = false;
nameservers = [
"1.1.1.1"
"1.0.0.1"
];
nftables = {
enable = true;
flushRuleset = false;
};
firewall = {
enable = true;
allowedTCPPorts = [
80
443
];
};
};
systemd.network = {
enable = true;
wait-online.anyInterface = true;
};
boot = {
kernelPackages = pkgs.linuxPackages_latest;
kernel.sysctl = {
# turn all of the ip forwarding on
"net.ipv4.ip_forward" = lib.mkDefault 1;
"net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
"net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
};
# mitigations
blacklistedKernelModules = [
# copy fail (cve-2026-31431)
"algif_aead"
# dirty frag (cve-2026-43284)
"esp4" # ipv4 ipsec esp variant
"esp6" # ipv6 ipsec esp variant
"rxrpc" # rxrpc variant
# note: these mitigations kill ipsec, though we never use it.
];
};
services.envfs.enable = true;
virtualisation = {
oci-containers.backend = "docker";
# we need these settings to allow our networks to be ipv6-enabled and
# to make docker support nftables directly without any compat layers.
# we also ignore the default bridge, because it's setup
# is a lot more complicated...
docker = {
enable = true;
autoPrune.enable = true;
# required to support nftables natively.
# see: https://docs.docker.com/engine/network/firewall-nftables
package = pkgs.docker_29;
extraPackages = [ pkgs.nftables ];
daemon.settings = {
"metrics-addr" = "${me.tailscale.ip}:9323";
# ipv6 support
"ipv6" = true;
"ip6tables" = true;
# nftables options
"experimental" = true;
"ip-forward" = true;
"firewall-backend" = "nftables";
};
};
};
systemd.services.docker.path = [ pkgs.nftables ]; # add nft tool into docker
services = {
openssh = {
enable = true;
openFirewall = false;
listenAddresses = [
{
addr = me.tailscale.ip;
port = 22;
}
];
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
};
# sometimes needed for gnupg
pcscd.enable = true;
};
foundation.tailnetServices = [
"docker"
"sshd"
];
programs = {
fish.enable = true;
git.enable = true;
tmux.enable = true;
gnupg.agent = {
enable = true;
enableSSHSupport = true;
pinentryPackage = pkgs.pinentry-curses;
};
};
environment.systemPackages = (
with pkgs;
[
file
unzip
jq
dig
htop
glances
wget
gnupg
pinentry-curses
age
agenix
inetutils
pciutils
lshw
inxi
iw
dmidecode
tcpdump
nftables
wireguard-tools
ffmpeg_7-headless
ripgrep
gnumake
gdb
gcc
clang
dtc
go
gopls
delve
go-task
meson
cmake
nil
direnv
nixfmt-rfc-style
dive
compose2nix
nix-prefetch-docker
borgbackup
]
);
}
|
