blob: 576603768f141e6a63f8438aa53b74996e98fc12 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
{ me, util, config, lib, pkgs, ... }:
{
imports = [
./foundation
./nix.nix
./user.nix
./locale.nix
./tailscale.nix
./nix-ld.nix
./vim.nix
];
boot.kernelPackages = pkgs.linuxPackages_latest;
# fish enables this by default,
# it makes every nixos rebuild very slow.
documentation.man.generateCaches = false;
users.motd = ''
/^ /^
\ ' ' 7 < Hi, I'm ${util.titleCase me.name}
/ \
'';
networking = {
hostName = me.name;
useDHCP = false;
dhcpcd.enable = false;
nameservers = [ "1.1.1.1" "1.0.0.1" ];
nftables = {
enable = true;
flushRuleset = false;
};
firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
};
};
systemd.network = {
enable = true;
wait-online.anyInterface = true;
};
boot.kernel.sysctl = {
# turn all of the ip forwarding on
"net.ipv4.ip_forward" = lib.mkDefault 1;
"net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
"net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
};
services.envfs.enable = true;
virtualisation = {
oci-containers.backend = "docker";
# we need these settings to allow our networks to be ipv6-enabled and
# to make docker support nftables directly without any compat layers.
# we also ignore the default bridge, because it's setup
# is a lot more complicated...
docker = {
enable = true;
autoPrune.enable = true;
# required to support nftables natively.
# see: https://docs.docker.com/engine/network/firewall-nftables
package = pkgs.docker_29;
extraPackages = [ pkgs.nftables ];
daemon.settings = {
"metrics-addr" = "${me.tailscale.ip}:9323";
# ipv6 support
"ipv6" = true;
"ip6tables" = true;
# nftables options
"experimental" = true;
"ip-forward" = true;
"firewall-backend" = "nftables";
};
};
};
systemd.services.docker.path = [ pkgs.nftables ]; # add nft tool into docker
services = {
openssh = {
enable = true;
openFirewall = false;
listenAddresses = [{ addr = me.tailscale.ip; port = 22; }];
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
};
# sometimes needed for gnupg
pcscd.enable = true;
};
foundation.tailnetServices = [
"docker"
"sshd"
];
programs = {
fish.enable = true;
git.enable = true;
tmux.enable = true;
gnupg.agent = {
enable = true;
enableSSHSupport = true;
pinentryPackage = pkgs.pinentry-curses;
};
};
environment.systemPackages = (with pkgs; [
file unzip jq dig htop glances wget
gnupg pinentry-curses age agenix
inetutils pciutils lshw inxi iw dmidecode
tcpdump
nftables wireguard-tools
ffmpeg_7-headless
ripgrep gnumake gdb gcc clang dtc
go gopls delve go-task
meson cmake
nil direnv nixfmt-rfc-style
dive compose2nix nix-prefetch-docker
borgbackup
]);
}
|
