70 lines
2.2 KiB
Nix
70 lines
2.2 KiB
Nix
{lib, ...}: {
|
|
# https://nixos.wiki/wiki/Networking
|
|
# https://nixos.wiki/wiki/Systemd-networkd
|
|
|
|
networking = {
|
|
firewall = {
|
|
# Allow some ports for ad-hoc use
|
|
allowedTCPPorts = [1234 1337 8000 8080];
|
|
allowedUDPPorts = [1234 1337 8000 8080];
|
|
# Do not spam dmesg/journalctl with refused connections
|
|
logRefusedConnections = false;
|
|
};
|
|
nameservers = ["127.0.0.53"]; # unbound
|
|
search = ["caspervk.net"];
|
|
};
|
|
|
|
# TODO: these systemd networkd settings will be the default once
|
|
# https://github.com/NixOS/nixpkgs/pull/202488 is merged.
|
|
networking.useNetworkd = true;
|
|
systemd.network.enable = true;
|
|
|
|
# Force-disable the systemd-resolved stub resolver, which is enabled
|
|
# automatically in some cases, such as when enabling systemd-networkd.
|
|
services.resolved.enable = lib.mkForce false;
|
|
|
|
# Unbound provides DNS resolution to local applications on 127.0.0.53. It
|
|
# enables caching and DNSSEC validation by default. We configure it to only,
|
|
# and always, use dns.caspervk.net over TLS.
|
|
# By the way, it's surprisingly hard to get the system to always follow the
|
|
# custom DNS servers rather than the DHCP-provided ones. Check the traffic
|
|
# with: sudo tcpdump -n --interface=any '(udp port 53) or (tcp port 853)'
|
|
# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html
|
|
services.unbound = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
interface = ["127.0.0.53"];
|
|
};
|
|
forward-zone = [
|
|
{
|
|
name = ".";
|
|
forward-addr = [
|
|
"159.69.4.2#dns.caspervk.net"
|
|
"2a01:4f8:1c0c:70d1::1#dns.caspervk.net"
|
|
];
|
|
forward-tls-upstream = "yes";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# TCP BBR has significantly increased throughput and reduced latency. Note
|
|
# that the IPv4 setting controls both IPv4 and IPv6.
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.tcp_congestion_control" = "bbr";
|
|
};
|
|
|
|
# vnStat keeps a log of hourly, daily and monthly network traffic
|
|
services.vnstat.enable = true;
|
|
environment.persistence."/nix/persist" = {
|
|
directories = [
|
|
{
|
|
directory = "/var/lib/vnstat";
|
|
user = "root";
|
|
group = "root";
|
|
mode = "0755";
|
|
}
|
|
];
|
|
};
|
|
}
|