s0me1newithhand7s/reNixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

big staging update

Browse source 
Signed-off-by: s0me1newithhand7s <git+me@hand7s.org>
This commit is contained in:
s0me1newithhand7s 2025-12-29 16:42:07 +03:00
parent 0bf4c9cfca
commit 2939b08891
324 changed files with 6897 additions and 6797 deletions
Download patch file Download diff file Expand all files Collapse all files

28
s0mev1rtn0de-nix/networking/dns.nix
View file

@ -1,16 +1,16 @@
{...}: {
networking = {
nameservers = [
"1.1.1.1"
"1.0.0.1"
"8.8.8.8"
"8.8.4.4"
"2606:4700:4700::1111"
"2606:4700:4700::1001"
"2001:4860:4860::8888"
"2001:4860:4860::8844"
"2620:119:35::35"
"2620:119:53::53"
];
};
networking = {
nameservers = [
"1.1.1.1"
"1.0.0.1"
"8.8.8.8"
"8.8.4.4"
"2606:4700:4700::1111"
"2606:4700:4700::1001"
"2001:4860:4860::8888"
"2001:4860:4860::8844"
"2620:119:35::35"
"2620:119:53::53"
];
};
}

16
s0mev1rtn0de-nix/networking/firewall.nix
View file

@ -1,11 +1,11 @@
{...}: {
networking = {
firewall = {
enable = true;
allowPing = true;
checkReversePath = false;
};
useNetworkd = true;
networking = {
firewall = {
enable = true;
allowPing = true;
checkReversePath = false;
};
useNetworkd = true;
};
}

32
s0mev1rtn0de-nix/networking/firewall/ens3.nix
View file

@ -1,21 +1,21 @@
{...}: {
networking = {
firewall = {
interfaces = {
ens3 = {
allowedUDPPorts = [
443
53590
53570
];
networking = {
firewall = {
interfaces = {
ens3 = {
allowedUDPPorts = [
443
53590
53570
];
allowedTCPPorts = [
443
53590
53570
];
};
};
allowedTCPPorts = [
443
53590
53570
];
};
};
};
};
}

24
s0mev1rtn0de-nix/networking/firewall/wt0.nix
View file

@ -1,17 +1,17 @@
{...}: {
networking = {
firewall = {
interfaces = {
wt0 = {
allowedUDPPorts = [
39856
];
networking = {
firewall = {
interfaces = {
wt0 = {
allowedUDPPorts = [
39856
];
allowedTCPPorts = [
39856
];
};
};
allowedTCPPorts = [
39856
];
};
};
};
};
}

6
s0mev1rtn0de-nix/networking/hostname.nix
View file

@ -1,5 +1,5 @@
{...}: {
networking = {
hostName = "s0mev1rtn0de-nix";
};
networking = {
hostName = "s0mev1rtn0de-nix";
};
}

24
s0mev1rtn0de-nix/networking/interfaces/ens3.nix
View file

@ -1,16 +1,16 @@
{...}: {
networking = {
interfaces = {
ens3 = {
ipv6 = {
addresses = [
{
address = "";
prefixLength = 128;
}
];
};
};
networking = {
interfaces = {
ens3 = {
ipv6 = {
addresses = [
{
address = "";
prefixLength = 128;
}
];
};
};
};
};
}

18
s0mev1rtn0de-nix/networking/nat.nix
View file

@ -1,12 +1,12 @@
{...}: {
networking = {
nat = {
enable = true;
enableIPv6 = true;
externalInterface = "ens3";
internalInterfaces = [
"wg0"
];
};
networking = {
nat = {
enable = true;
enableIPv6 = true;
externalInterface = "ens3";
internalInterfaces = [
"wg0"
];
};
};
}

8
s0mev1rtn0de-nix/networking/nftables.nix
View file

@ -1,7 +1,7 @@
{...}: {
networking = {
nftables = {
enable = false;
};
networking = {
nftables = {
enable = false;
};
};
}

80
s0mev1rtn0de-nix/networking/wg-quick.nix
View file

@ -1,50 +1,50 @@
{
config,
pkgs,
lib,
...
config,
pkgs,
lib,
...
}: {
networking = {
wg-quick = {
interfaces = {
wg0 = {
type = "wireguard";
listenPort = 53590;
privateKeyFile = config.sops.secrets.privateWgKey;
networking = {
wg-quick = {
interfaces = {
wg0 = {
type = "wireguard";
listenPort = 53590;
privateKeyFile = config.sops.secrets.privateWgKey;
address = [
"10.100.0.1/24"
];
address = [
"10.100.0.1/24"
];
postUp = ''
${lib.getExe' pkgs.iptables "iptables"} -A FORWARD -i wg0 -j ACCEPT
${lib.getExe' pkgs.iptables "iptables"} -t nat -A POSTROUTING -s 10.100.0.0/24 -o ens3 -j MASQUERADE
'';
postUp = ''
${lib.getExe' pkgs.iptables "iptables"} -A FORWARD -i wg0 -j ACCEPT
${lib.getExe' pkgs.iptables "iptables"} -t nat -A POSTROUTING -s 10.100.0.0/24 -o ens3 -j MASQUERADE
'';
preDown = ''
${lib.getExe' pkgs.iptables "iptables"} -D FORWARD -i wg0 -j ACCEPT
${lib.getExe' pkgs.iptables "iptables"} -t nat -D POSTROUTING -s 10.100.0.0/24 -o ens3 -j MASQUERADE
'';
preDown = ''
${lib.getExe' pkgs.iptables "iptables"} -D FORWARD -i wg0 -j ACCEPT
${lib.getExe' pkgs.iptables "iptables"} -t nat -D POSTROUTING -s 10.100.0.0/24 -o ens3 -j MASQUERADE
'';
peers = [
{
publicKey = "{}";
presharedKeyFile = config.sops.secrets.presharedWgKey1;
allowedIPs = [
"10.100.0.2/32"
];
}
peers = [
{
publicKey = "{}";
presharedKeyFile = config.sops.secrets.presharedWgKey1;
allowedIPs = [
"10.100.0.2/32"
];
}
{
publicKey = "{}";
presharedKeyFile = config.sops.secrets.presharedWgKey2;
allowedIPs = [
"10.100.0.3/32"
];
}
];
};
};
{
publicKey = "{}";
presharedKeyFile = config.sops.secrets.presharedWgKey2;
allowedIPs = [
"10.100.0.3/32"
];
}
];
};
};
};
};
}

8
s0mev1rtn0de-nix/networking/wireguard.nix
View file

@ -1,7 +1,7 @@
{...}: {
networking = {
wireguard = {
enable = true;
};
networking = {
wireguard = {
enable = true;
};
};
}