summaryrefslogtreecommitdiff
path: root/modules/nixos/personal/networking/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'modules/nixos/personal/networking/default.nix')
-rw-r--r--modules/nixos/personal/networking/default.nix50
1 files changed, 29 insertions, 21 deletions
diff --git a/modules/nixos/personal/networking/default.nix b/modules/nixos/personal/networking/default.nix
index 3caddb1..cef72eb 100644
--- a/modules/nixos/personal/networking/default.nix
+++ b/modules/nixos/personal/networking/default.nix
@@ -4,16 +4,19 @@
pkgs,
options,
...
-}: let
+}:
+let
cfg = config.personal.networking;
- mkFirewallEnableOption = name:
+ mkFirewallEnableOption =
+ name:
lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to open ports for ${name}.";
};
-in {
- imports = [./wifi.nix];
+in
+{
+ imports = [ ./wifi.nix ];
options.personal.networking = {
enable = lib.mkEnableOption "networking";
@@ -28,19 +31,24 @@ in {
};
config = lib.mkIf cfg.enable {
- environment.systemPackages =
- lib.optional cfg.networkmanager.enable pkgs.networkmanager;
+ environment.systemPackages = lib.optional cfg.networkmanager.enable pkgs.networkmanager;
networking = {
networkmanager = lib.mkIf cfg.networkmanager.enable {
enable = true;
- unmanaged = ["interface-name:ve-*"];
+ unmanaged = [ "interface-name:ve-*" ];
};
firewall = {
enable = true;
allowedTCPPorts =
lib.optional cfg.firewall.syncthing 22000
- ++ lib.optionals cfg.firewall.http [80 443];
- allowedUDPPorts = lib.optionals cfg.firewall.syncthing [22000 21027];
+ ++ lib.optionals cfg.firewall.http [
+ 80
+ 443
+ ];
+ allowedUDPPorts = lib.optionals cfg.firewall.syncthing [
+ 22000
+ 21027
+ ];
allowedTCPPortRanges = lib.optional cfg.firewall.kdeconnect {
from = 1714;
to = 1764;
@@ -52,26 +60,26 @@ in {
};
};
services = lib.mkIf cfg.ssh.enable {
- openssh =
- {
- enable = true;
- extraConfig = ''
- AcceptEnv PS1
- '';
- }
- // (
- if options.services.openssh ? settings
- then {
+ openssh = {
+ enable = true;
+ extraConfig = ''
+ AcceptEnv PS1
+ '';
+ }
+ // (
+ if options.services.openssh ? settings then
+ {
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
};
}
- else {
+ else
+ {
permitRootLogin = "no";
passwordAuthentication = false;
}
- );
+ );
fail2ban = {
enable = true;
maxretry = 16;