126 lines
3.1 KiB
Nix
126 lines
3.1 KiB
Nix
{ config, lib, pkgs, ... }:
|
||
|
||
let
|
||
iptablesAppendIfMissing = rule: "iptables -C " + rule + " || iptables -A " + rule;
|
||
iptablesInsertIfMissing = rule: "iptables -C " + rule + " || iptables -I " + rule;
|
||
in
|
||
{
|
||
imports = [
|
||
./hardware-configuration.nix
|
||
../../home-manager/users/jalr.nix
|
||
./services
|
||
];
|
||
|
||
networking.hostName = "aluminium";
|
||
services.openssh.enable = true;
|
||
security.sudo.wheelNeedsPassword = false;
|
||
|
||
networking = {
|
||
useDHCP = false;
|
||
vlans = {
|
||
lechner = {
|
||
id = 1;
|
||
interface = "enp1s0";
|
||
};
|
||
voice = {
|
||
id = 2;
|
||
interface = "enp1s0";
|
||
};
|
||
pv = {
|
||
id = 10;
|
||
interface = "enp1s0";
|
||
};
|
||
heizung = {
|
||
id = 11;
|
||
interface = "enp1s0";
|
||
};
|
||
};
|
||
interfaces = {
|
||
lechner.ipv4.addresses = [{
|
||
address = "192.168.0.1";
|
||
prefixLength = 24;
|
||
}];
|
||
voice.ipv4.addresses = [{
|
||
address = "192.168.1.1";
|
||
prefixLength = 24;
|
||
}];
|
||
pv.ipv4.addresses = [{
|
||
address = "192.168.10.1";
|
||
prefixLength = 30;
|
||
}];
|
||
heizung.ipv4.addresses = [{
|
||
address = "192.168.10.5";
|
||
prefixLength = 24;
|
||
}];
|
||
enp2s0.useDHCP = false;
|
||
};
|
||
nat = {
|
||
enable = true;
|
||
externalInterface = "ppp0";
|
||
internalInterfaces = [
|
||
"lechner"
|
||
"voice"
|
||
];
|
||
};
|
||
firewall = {
|
||
extraCommands = lib.concatStringsSep "\n" [
|
||
(iptablesAppendIfMissing "FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu")
|
||
(iptablesInsertIfMissing "INPUT -i voice -p udp -m udp --dport 5060 -j ACCEPT")
|
||
(iptablesInsertIfMissing "INPUT -s 217.10.68.150 -p udp --dport 5060 -j ACCEPT")
|
||
];
|
||
};
|
||
};
|
||
|
||
|
||
sops.secrets.pap-secrets = {
|
||
sopsFile = ./secrets.yaml;
|
||
};
|
||
environment.etc."ppp/pap-secrets".source = config.sops.secrets.pap-secrets.path;
|
||
services.pppd = {
|
||
enable = true;
|
||
peers = {
|
||
pyur = {
|
||
enable = true;
|
||
name = "pyur";
|
||
config = ''
|
||
#debug
|
||
defaultroute
|
||
hide-password
|
||
holdoff 5
|
||
ipcp-accept-local
|
||
ipcp-accept-remote
|
||
lcp-echo-failure 10
|
||
lcp-echo-interval 60
|
||
maxfail 0
|
||
#mtu 1470
|
||
name pyur
|
||
noauth
|
||
noccp
|
||
noipdefault
|
||
noipv6
|
||
novjccomp
|
||
persist
|
||
plugin pppoe.so enp2s0
|
||
user l8545506
|
||
'';
|
||
};
|
||
};
|
||
};
|
||
|
||
zramSwap = {
|
||
enable = true;
|
||
algorithm = "zstd";
|
||
memoryPercent = 60;
|
||
priority = 1;
|
||
};
|
||
|
||
# This value determines the NixOS release from which the default
|
||
# settings for stateful data, like file locations and database versions
|
||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||
# this value at the release version of the first install of this system.
|
||
# Before changing this value read the documentation for this option
|
||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||
system.stateVersion = "22.05"; # Did you read the comment?
|
||
|
||
}
|
||
|