/nix/store/dlwqlnbaj5vfm9aw20r1yxk8y56lmgif-repo/header.tmpl
6 changed files with
42 additions and
117 deletions
@ -15,6 +15,11 @@
fstrim . enable = lib . mkDefault true ;
thermald . enable = true ;
printing . enable = true ;
avahi = {
enable = true ;
nssmdns4 = true ;
openFirewall = true ;
} ;
} ;
virtualisation . docker . enable = true ;
@ -1,55 +0,0 @@
{
config ,
lib ,
pkgs ,
. . .
} : let
StateDirectory = " d n s c r y p t - p r o x y " ;
inherit ( lib . modules ) mkForce ;
in {
networking = {
networkmanager . dns = mkForce " n o n e " ;
nameservers = [
" 1 2 7 . 0 . 0 . 1 "
" : : 1 "
] ;
} ;
# See https://wiki.nixos.org/wiki/Encrypted_DNS
services . dnscrypt-proxy2 = {
enable = true ;
# See https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml
settings = {
sources . public-resolvers = {
urls = [
" h t t p s : / / r a w . g i t h u b u s e r c o n t e n t . c o m / D N S C r y p t / d n s c r y p t - r e s o l v e r s / m a s t e r / v 3 / p u b l i c - r e s o l v e r s . m d "
" h t t p s : / / d o w n l o a d . d n s c r y p t . i n f o / r e s o l v e r s - l i s t / v 3 / p u b l i c - r e s o l v e r s . m d "
] ;
minisign_key = " R W Q f 6 L R C G A 9 i 5 3 m l Y e c O 4 I z T 5 1 T G P p v W u c N S C h 1 C B M 0 Q T a L n 7 3 Y 7 G F O 3 " ; # See https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
cache_file = " / v a r / l i b / ${ StateDirectory } / p u b l i c - r e s o l v e r s . m d " ;
} ;
# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
ipv6_servers = true ;
# Server must support DNS security extensions (DNSSEC)
require_dnssec = true ;
# Server must not log user queries (declarative)
require_nolog = true ;
# Server must not enforce its own blocklist (for parental control, ads blocking...)
require_nofilter = true ;
## Enable *experimental* support for HTTP/3 (DoH3, HTTP over QUIC)
## Note that, like DNSCrypt but unlike other HTTP versions, this uses
## UDP and (usually) port 443 instead of TCP.
http3 = false ;
## Enable a DNS cache to reduce latency and outgoing traffic.
cache = true ;
} ;
} ;
systemd . services . dnscrypt-proxy2 . serviceConfig . StateDirectory = StateDirectory ;
}
@ -1,18 +0,0 @@
{
config ,
lib ,
pkgs ,
. . .
} : let
in {
networking = {
# use nftables over iptables
nftables . enable = true ;
firewall = {
enable = true ;
allowPing = false ;
logReversePathDrops = true ;
} ;
} ;
}
@ -3,55 +3,43 @@
in {
imports = [
./networkmanager.nix
./dns.nix
./firewall.nix
] ;
networking = {
enableIPv6 = true ;
wireless = {
# INFO: This disables wpa_supplicant,
# I use iwd instead.
enable = false ;
# use iwd over wpa_supplicant
iwd = {
enable = true ;
settings = {
IPv6 = {
Enabled = true ;
} ;
Settings = {
AutoConnect = true ;
} ;
} ;
} ;
} ;
# INFO: This disables wpa_supplicant,
# I use nenetworkmanager instead.
wireless . enable = false ;
dhcpcd = {
# faster boot times
wait = " b a c k g r o u n d " ;
# do not edit resolv.conf
extraConfig = ''
nohook resolv . conf
'' ;
extraConfig = " n o a r p " ;
} ;
} ;
# service discovery on a local network via the mDNS/DNS-SD protocol suite
services . avahi = {
nameservers = [
# I have choosen Mullvad DNS as my standard DNS provider,
# as Quad9 at some point stopped resolving my universitie's IP address.
# Furthermore, Mullvad has a pretty good reputation when it comes to privacy
" 1 9 4 . 2 4 2 . 2 . 4 "
" 2 a 0 7 : e 3 4 0 : : 4 "
] ;
} ;
services . resolved = {
enable = true ;
nssmdns4 = true ;
openFirewall = true ;
dnssec = " f a l s e " ;
dnsovertls = " o p p o r t u n i s t i c " ;
fallbackDns = [
" 1 9 4 . 2 4 2 . 2 . 4 "
" 2 a 0 7 : e 3 4 0 : : 4 "
] ;
} ;
users . users . ${ username } . extraGroups = [ " n e t w o r k m a n a g e r " ] ;
# faster boot
systemd = {
network = {
enable = true ;
wait-online . enable = false ;
} ;
} ;
# systemd = {
# network = {
# enable = true;
# wait-online.anyInterface = true;
# };
# };
}
@ -1,7 +1,16 @@
_ : {
{ lib , . . . }: let
inherit ( lib . modules ) mkForce ;
in {
networking . networkmanager = {
enable = true ;
# # Removes about 2GB of stuff we do no need.
# plugins = mkForce [];
dns = " s y s t e m d - r e s o l v e d " ;
unmanaged = [
# DO NOT manage my docker containers, thank you.
" i n t e r f a c e - n a m e : d o c k e r * "
] ;
wifi = {
# Generate a randomized value upon each connect
macAddress = " r a n d o m " ;
@ -10,11 +19,8 @@ _: {
powersave = true ;
# Backend is either wpa_supplicant or iwd,
# I use iwd.
backend = " i w d " ;
# Whether to enable MAC address randomization of a Wi-Fi device during scanning.
scanRandMacAddress = true ;
# I use wpa_supplicant since it is simply more reliable.
backend = " w p a _ s u p p l i c a n t " ;
} ;
} ;
}
@ -6,7 +6,6 @@ _: {
rounding_power = 3 ;
blur = {
enabled = true ;
xray = true ;
size = 3 ;
passes = 2 ;
} ;