75 lines
1.8 KiB
Nix
75 lines
1.8 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
secrets,
|
|
...
|
|
}:
|
|
{
|
|
boot.kernelParams = [
|
|
"biosdevname=0"
|
|
"net.ifnames=0"
|
|
];
|
|
my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ];
|
|
networking = {
|
|
networkmanager.enable = true;
|
|
firewall = {
|
|
enable = true;
|
|
checkReversePath = false;
|
|
allowPing = false;
|
|
extraInputRules = ''
|
|
ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
|
|
ip6 saddr { fd00::/8, fe80::/10 } accept
|
|
'';
|
|
filterForward = true;
|
|
};
|
|
nftables.enable = true;
|
|
};
|
|
|
|
sops.secrets.dae-imxyy-nix-x16 = {
|
|
sopsFile = secrets.dae-imxyy-nix-x16;
|
|
restartUnits = [ "dae.service" ];
|
|
format = "binary";
|
|
};
|
|
services.dae = {
|
|
enable = true;
|
|
configFile = config.sops.secrets.dae-imxyy-nix-x16.path;
|
|
openFirewall.enable = false;
|
|
};
|
|
systemd.services.dae.after = [ "sops-nix.service" ];
|
|
sops.secrets.mihomo = {
|
|
sopsFile = secrets.mihomo;
|
|
restartUnits = [ "mihomo.service" ];
|
|
format = "yaml";
|
|
key = "";
|
|
};
|
|
systemd.services.mihomo.after = [ "sops-nix.service" ];
|
|
services.mihomo = {
|
|
enable = true;
|
|
configFile = config.sops.secrets.mihomo.path;
|
|
webui = pkgs.metacubexd;
|
|
};
|
|
|
|
sops.secrets.et-imxyy-nix-x16 = {
|
|
sopsFile = secrets.et-imxyy-nix-x16;
|
|
restartUnits = [ "easytier.service" ];
|
|
format = "binary";
|
|
};
|
|
environment.systemPackages = with pkgs; [
|
|
easytier
|
|
];
|
|
systemd.services."easytier" = {
|
|
enable = true;
|
|
script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-x16.path}";
|
|
serviceConfig = {
|
|
Restart = "always";
|
|
RestartSec = 30;
|
|
User = "root";
|
|
};
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [
|
|
"network.target"
|
|
"sops-nix.service"
|
|
];
|
|
};
|
|
}
|