Skip to content

Commit d6dd317

Browse files
randomizedcoderrandomizedcoder
committed
l2 ap working
1 parent 9e62147 commit d6dd317

File tree

17 files changed

+454
-135
lines changed

17 files changed

+454
-135
lines changed

‎desktop/l/flake.nix‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,14 @@
2525
inherit system;
2626
config = {
2727
allowUnfree = true;
28-
allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
29-
# "nvidia-x11"
30-
# "nvidia-settings"
31-
# "nvidia-persistenced"
32-
"google-chrome"
33-
"android-studio"
34-
"android-studio-stable"
35-
];
28+
allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
29+
# "nvidia-x11"
30+
# "nvidia-settings"
31+
# "nvidia-persistenced"
32+
"google-chrome"
33+
"android-studio"
34+
"android-studio-stable"
35+
];
3636
};
3737
};
3838
lib = nixpkgs.lib;

‎desktop/l/home.nix‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -373,24 +373,24 @@
373373
tmux
374374
screen
375375

376-
# LLVM/Clang toolchain (needed for race detection and C/C++ builds)
377-
llvmPackages_20.clang-tools
378-
llvmPackages_20.lld
379-
380-
# LLVM C++ Standard Library, compiler runtime, and unwind library
381-
llvmPackages_20.stdenv
382-
llvmPackages_20.libcxxStdenv
383-
llvmPackages_20.libcxxClang
384-
llvmPackages_20.libcxx # Provides libc++.so, libc++.a (libraries)
385-
llvmPackages_20.libcxx.dev # Provides C++ headers
386-
# do NOT include llvm.libc-full, because it will override glibc
387-
#llvm.libc-full
388-
llvmPackages_20.compiler-rt # Provides libclang_rt.builtins*.a
389-
llvmPackages_20.compiler-rt.dev # Provides libclang_rt headers
390-
llvmPackages_20.libunwind # Provides libunwind for exception handling
391-
llvmPackages_20.libunwind.dev # Provides libunwind headers
392-
393-
libclang libclang.dev libclang.lib
376+
# # LLVM/Clang toolchain (needed for race detection and C/C++ builds)
377+
# llvmPackages_20.clang-tools
378+
# llvmPackages_20.lld
379+
380+
# # LLVM C++ Standard Library, compiler runtime, and unwind library
381+
# #llvmPackages_20.stdenv
382+
# llvmPackages_20.libcxxStdenv
383+
# llvmPackages_20.libcxxClang
384+
# llvmPackages_20.libcxx # Provides libc++.so, libc++.a (libraries)
385+
# llvmPackages_20.libcxx.dev # Provides C++ headers
386+
# # do NOT include llvm.libc-full, because it will override glibc
387+
# #llvm.libc-full
388+
# llvmPackages_20.compiler-rt # Provides libclang_rt.builtins*.a
389+
# llvmPackages_20.compiler-rt.dev # Provides libclang_rt headers
390+
# llvmPackages_20.libunwind # Provides libunwind for exception handling
391+
# llvmPackages_20.libunwind.dev # Provides libunwind headers
392+
393+
# llvmPackages_20.libclang llvmPackages_20.libclang.dev llvmPackages_20.libclang.lib
394394

395395
# Essential development libraries (minimal headers)
396396
glibc glibc.dev glibc.static

‎desktop/l2/configuration.nix‎

Lines changed: 9 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,13 @@
3232
./grafana.nix
3333
# clickhouse
3434
#./docker-compose.nix
35-
./docker-daemon.nix
35+
#./docker-daemon.nix
3636
#./smokeping.nix
3737
#./distributed-builds.nix
3838
#./hyprland.nix
3939
#./hostapd.nix
4040
./hostapd-multi.nix
41+
./network-optimization.nix
4142
];
4243

4344
boot = {
@@ -164,27 +165,17 @@
164165
enableSSHSupport = true;
165166
};
166167

167-
# https://nixos.wiki/wiki/Virt-manager
168-
virtualisation.libvirtd.enable = true;
169-
#programs.virt-manager.enable = true;
170-
virtualisation.spiceUSBRedirection.enable = true;
168+
# # https://nixos.wiki/wiki/Virt-manager
169+
# virtualisation.libvirtd.enable = true;
170+
# #programs.virt-manager.enable = true;
171+
# virtualisation.spiceUSBRedirection.enable = true;
171172

172-
virtualisation.containers = {
173-
ociSeccompBpfHook.enable = true;
174-
};
175-
176-
# guest
177-
# services.qemuGuest.enable = true;
178-
# services.spice-vdagentd.enable = true;
179-
180-
# https://wiki.nixos.org/wiki/Laptop
173+
# virtualisation.containers = {
174+
# ociSeccompBpfHook.enable = true;
175+
# };
181176

182177
system.stateVersion = "24.11";
183178

184-
nixpkgs.config = {
185-
allowUnfree = true;
186-
};
187-
188179
}
189180

190181
# end

‎desktop/l2/firewall.nix‎

Lines changed: 78 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,83 @@
11
{ config, pkgs, ... }:
22

33
{
4-
# Open ports in the firewall.
5-
# networking.firewall.allowedTCPPorts = [ ... ];
6-
# networking.firewall.allowedUDPPorts = [ ... ];
7-
# Or disable the firewall altogether.
8-
# networking.firewall.enable = false;
9-
10-
# https://nixos.wiki/wiki/Firewall
11-
# https://scvalex.net/posts/54/
12-
# sudo nft --stateless list table filter
13-
# sudo sudo iptables-save
14-
networking.firewall = {
15-
enable = false;
16-
allowedTCPPorts = [
17-
22 # ssh
18-
5001 # iperf2
19-
];
20-
# allowedTCPPorts = [ 22 5001 ];
21-
# #allowedUDPPortRanges = [
22-
# # { from = 4000; to = 4007; }
23-
# # { from = 8000; to = 8010; }
24-
# #];
25-
# NixOS automagically creates stateful connection tracking, which we don't want
26-
# for performance reasons
27-
# extraCommands = ''
28-
# iptables --delete nixos-fw -m conntrack --ctstate RELATED,ESTABLISHED -j nixos-fw-accept || true
29-
# '';
4+
# Disable the default iptables firewall since we're using nftables
5+
networking.firewall.enable = false;
6+
7+
# Enable nftables with connection tracking for maximum security
8+
networking.nftables = {
9+
enable = true;
10+
ruleset = ''
11+
table inet filter {
12+
chain input {
13+
type filter hook input priority 0; policy drop;
14+
15+
# Enable connection tracking
16+
ct state established,related accept
17+
ct state invalid drop
18+
19+
# Allow loopback
20+
iif lo accept
21+
oif lo accept
22+
23+
# Allow SSH from anywhere
24+
tcp dport 22 accept
25+
26+
# Allow DNS queries
27+
udp dport 53 accept
28+
tcp dport 53 accept
29+
30+
# Allow DHCP
31+
udp dport 67 accept
32+
udp dport 547 accept
33+
34+
# Allow ICMP (ping, etc.)
35+
icmp type echo-request accept
36+
icmpv6 type echo-request accept
37+
38+
# Allow RA (Router Advertisement)
39+
icmpv6 type nd-router-advert accept
40+
}
41+
42+
chain forward {
43+
type filter hook forward priority 0; policy drop;
44+
45+
# Allow traffic from internal network to external
46+
# Use meta iifname to avoid interface existence check at load time
47+
meta iifname "br0" oifname "enp1s0" accept
48+
49+
# Allow return traffic from external to internal
50+
meta iifname "enp1s0" oifname "br0" ct state established,related accept
51+
}
52+
53+
chain output {
54+
type filter hook output priority 0; policy accept;
55+
}
56+
}
57+
58+
table ip nat {
59+
chain prerouting {
60+
type nat hook prerouting priority dstnat;
61+
}
62+
63+
chain postrouting {
64+
type nat hook postrouting priority srcnat;
65+
# IPv4 masquerading
66+
meta oifname "enp1s0" masquerade
67+
}
68+
}
69+
70+
table ip6 nat {
71+
chain prerouting {
72+
type nat hook prerouting priority dstnat;
73+
}
74+
75+
chain postrouting {
76+
type nat hook postrouting priority srcnat;
77+
# IPv6 masquerading
78+
meta oifname "enp1s0" masquerade
79+
}
80+
}
81+
'';
3082
};
31-
# networking.firewall.interfaces."eth0".allowedTCPPorts = [ 80 443 ];
3283
}

‎desktop/l2/flake.nix‎

Lines changed: 46 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -18,28 +18,56 @@
1818
outputs = { self, nixpkgs, home-manager, ... }:
1919
let
2020
system = "x86_64-linux";
21+
22+
lib = nixpkgs.lib;
23+
24+
overlays = {
25+
default = final: prev: {
26+
hostapd = prev.hostapd.overrideDerivation (old: {
27+
version = "2.10";
28+
src = final.fetchurl {
29+
url = "https://w1.fi/releases/hostapd-2.10.tar.gz";
30+
sha256 = "0pcik0a6yin9nib02frjhaglmg44hwik086iwg1751b7kdwpqvi0";
31+
# nix-prefetch-url https://w1.fi/releases/hostapd-2.10.tar.gz
32+
};
33+
patches = [
34+
(final.fetchpatch {
35+
url = "https://tildearrow.org/storage/hostapd-2.10-lar.patch";
36+
sha256 = "USiHBZH5QcUJfZSxGoFwUefq3ARc4S/KliwUm8SqvoI=";
37+
})
38+
];
39+
});
40+
};
41+
};
42+
2143
pkgs = import nixpkgs {
2244
inherit system;
23-
config = {
24-
allowUnfree = true;
25-
};
45+
overlays = [ overlays.default ];
46+
config.allowUnfree = true;
2647
};
27-
lib = nixpkgs.lib;
48+
2849
in {
29-
nixosConfigurations = {
30-
l2 = lib.nixosSystem rec {
31-
inherit system;
32-
modules = [
33-
./configuration.nix
34-
home-manager.nixosModules.home-manager
35-
{
36-
home-manager.useUserPackages = true;
37-
home-manager.users.das = { config, pkgs, ... }: {
38-
imports = [ ./home.nix ];
39-
};
40-
}
41-
];
50+
nixosConfigurations = {
51+
l2 = lib.nixosSystem {
52+
53+
inherit system;
54+
55+
modules = [
56+
./configuration.nix
57+
{
58+
nixpkgs.pkgs = pkgs;
59+
}
60+
home-manager.nixosModules.home-manager
61+
{
62+
home-manager.useUserPackages = true;
63+
home-manager.users.das = { config, pkgs, ... }: {
64+
imports = [ ./home.nix ];
65+
};
66+
}
67+
];
68+
};
4269
};
4370
};
44-
};
4571
}
72+
73+
# end

‎desktop/l2/hardware-configuration.nix‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Do not modify this file! It was generated by ‘nixos-generate-config’
1+
# Do not modify this file! It was generated by 'nixos-generate-config'
22
# and may be overwritten by future invocations. Please make changes
33
# to /etc/nixos/configuration.nix instead.
44
{ config, lib, pkgs, modulesPath, ... }:
@@ -37,6 +37,5 @@
3737
# networking.useDHCP = lib.mkDefault true;
3838
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
3939

40-
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
4140
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
4241
}

0 commit comments

Comments
 (0)