refactor: inputs/ --> {sys,home}/

sys/modules/base/networking/default.nix

@@ -0,0 +1,29 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkIf;
+  host = config.systemModules.host;
+in
+
+{
+  imports = [
+    ./firewall.nix
+    ./tools.nix
+    ./ssh.nix
+    ./tcp.nix
+    ./resolved.nix
+    ./tailscale.nix
+  ];
+
+  config = mkIf (host.type != "phone") {
+    networking.networkmanager = {
+      enable = true;
+      dns = "systemd-resolved";
+    };
+
+    systemd = {
+      network.wait-online.enable = false;
+      services.NetworkManager-wait-online.enable = false;
+    };
+  };
+}

sys/modules/base/networking/firewall.nix

@@ -0,0 +1,18 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkIf;
+  host = config.systemModules.host;
+in
+
+{
+  config = mkIf (host.type != "phone") {
+    networking.firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        443 # https
+        57621 # spotify
+      ];
+    };
+  };
+}

sys/modules/base/networking/resolved.nix

@@ -0,0 +1,19 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkIf;
+  host = config.systemModules.host;
+in
+
+{
+  config = mkIf (host.type != "phone") {
+    services.resolved = {
+      enable = true;
+      fallbackDns = ["9.9.9.9"];
+      # allow-downgrade is vulnerable to downgrade attacks
+      extraConfig = ''
+         DNSOverTLS=yes # or allow-downgrade
+      '';
+    };
+  };
+}

sys/modules/base/networking/ssh.nix

@@ -0,0 +1,39 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkIf mkDefault;
+  key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBn3ff3HaZHIyH4K13k8Mwqu/o7jIABJ8rANK+r2PfJk";
+  phoneKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINredx07UAk2l1wUPujYnmJci1+XEmcUuSX0DIYg6Vzz";
+  host = config.systemModules.host;
+in
+
+{
+  config = mkIf (host.type != "phone") {
+    environment.sessionVariables.SSH_AUTH_SOCK = "~/.1password/agent.sock";
+
+    services.openssh = {
+      enable = true;
+      settings = {
+        UseDns = false;
+        PasswordAuthentication = false;
+        AuthenticationMethods = "publickey";
+        UsePAM = false;
+        PermitRootLogin = "no";
+        StreamLocalBindUnlink = "yes";
+        KbdInteractiveAuthentication = mkDefault false;
+      };
+    };
+
+    programs = {
+      ssh = {
+        knownHosts = {
+          "192.168.1.36".publicKey = phoneKey;
+        };
+      };
+      gnupg.agent = {
+        enable = true;
+        enableSSHSupport = true;
+      };
+    };
+  };
+}

sys/modules/base/networking/tailscale.nix

@@ -0,0 +1,62 @@
+{ lib, config, pkgs, ... }:
+
+let
+  cfg = config.systemModules.networking.tailscale;
+  inherit (config.services) tailscale;
+  inherit (lib.lists) optionals;
+  inherit (lib.types) bool listOf str; 
+  inherit (lib.strings) concatStringsSep;
+  inherit (lib) mkIf mkEnableOption mkOption mkDefault;
+in
+
+{
+  options.systemModules.networking.tailscale = {
+    enable = mkEnableOption "Enable tailscale system module";
+    server = mkOption {
+      type = bool;
+      default = false;
+      description = "Define if the host is a server";
+    };
+    client = mkOption {
+      type = bool;
+      default = cfg.enable;
+      description = "Define if the host is a client";
+    };
+    tag = mkOption {
+      type = listOf str;
+      default = 
+        if cfg.client then ["tag:client"]
+        else if cfg.server then ["tag:server"]
+        else [];
+      description = "Sets host tag depending on if server/client";
+    };
+    operator = mkOption {
+      type = str;
+      default = "ooks";
+      description = "Name of the tailscale operator";
+    };
+  };
+  
+  config = mkIf cfg.enable {
+
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = mkDefault "both";
+      # permitCertUid = "root";
+      extraUpFlags = 
+        [ "--ssh" "--operator=$USER" ]
+        ++ optionals cfg.server [ "--advertise-exit-node" ]
+        ++ optionals (cfg.tags != []) ["--advertise-tags" (concatStringsSep "," cfg.tags)]; 
+    };
+
+    networking.firewall = {
+      allowedUDPPorts = [tailscale.port];
+      trustedInterfaces = ["${tailscale.interfaceName}"];
+      checkReversePath = "loose";
+    };
+
+    systemd.network.wait-online.ignoredInterfaces = ["${tailscale.interfaceName}"];
+
+    environment.systemPackages = [ pkgs.tailscale ];
+  };
+}

sys/modules/base/networking/tcp.nix

@@ -0,0 +1,79 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkIf;
+  host = config.systemModules.host;
+in
+
+{
+  # nyx module
+  config = mkIf (host.type != "phone") {
+    boot = {
+      kernelModules = ["tls" "tcp_bbr"];
+      kernel.sysctl = {
+        # TCP hardening
+        # Prevent bogus ICMP errors from filling up logs.
+        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+        # Reverse path filtering causes the kernel to do source validation of
+        # packets received from all interfaces. This can mitigate IP spoofing.
+        "net.ipv4.conf.default.rp_filter" = 1;
+        "net.ipv4.conf.all.rp_filter" = 1;
+        # Do not accept IP source route packets (we're not a router)
+        "net.ipv4.conf.all.accept_source_route" = 0;
+        "net.ipv6.conf.all.accept_source_route" = 0;
+        # Don't send ICMP redirects (again, we're on a router)
+        "net.ipv4.conf.all.send_redirects" = 0;
+        "net.ipv4.conf.default.send_redirects" = 0;
+        # Refuse ICMP redirects (MITM mitigations)
+        "net.ipv4.conf.all.accept_redirects" = 0;
+        "net.ipv4.conf.default.accept_redirects" = 0;
+        "net.ipv4.conf.all.secure_redirects" = 0;
+        "net.ipv4.conf.default.secure_redirects" = 0;
+        "net.ipv6.conf.all.accept_redirects" = 0;
+        "net.ipv6.conf.default.accept_redirects" = 0;
+        # Protects against SYN flood attacks
+        "net.ipv4.tcp_syncookies" = 1;
+        # Incomplete protection again TIME-WAIT assassination
+        "net.ipv4.tcp_rfc1337" = 1;
+        # And other stuff
+        "net.ipv4.conf.all.log_martians" = true;
+        "net.ipv4.conf.default.log_martians" = true;
+        "net.ipv4.icmp_echo_ignore_broadcasts" = true;
+        "net.ipv6.conf.default.accept_ra" = 0;
+        "net.ipv6.conf.all.accept_ra" = 0;
+        "net.ipv4.tcp_timestamps" = 0;
+
+        # TCP optimization
+        # TCP Fast Open is a TCP extension that reduces network latency by packing
+        # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for
+        # both incoming and outgoing connections:
+        "net.ipv4.tcp_fastopen" = 3;
+        # Bufferbloat mitigations + slight improvement in throughput & latency
+        "net.ipv4.tcp_congestion_control" = "bbr";
+        "net.core.default_qdisc" = "cake";
+
+        # Other stuff that I am too lazy to document
+        "net.core.optmem_max" = 65536;
+        "net.core.rmem_default" = 1048576;
+        "net.core.rmem_max" = 16777216;
+        "net.core.somaxconn" = 8192;
+        "net.core.wmem_default" = 1048576;
+        "net.core.wmem_max" = 16777216;
+        "net.ipv4.ip_local_port_range" = "16384 65535";
+        "net.ipv4.tcp_max_syn_backlog" = 8192;
+        "net.ipv4.tcp_max_tw_buckets" = 2000000;
+        "net.ipv4.tcp_mtu_probing" = 1;
+        "net.ipv4.tcp_rmem" = "4096 1048576 2097152";
+        "net.ipv4.tcp_slow_start_after_idle" = 0;
+        "net.ipv4.tcp_tw_reuse" = 1;
+        "net.ipv4.tcp_wmem" = "4096 65536 16777216";
+        "net.ipv4.udp_rmem_min" = 8192;
+        "net.ipv4.udp_wmem_min" = 8192;
+        "net.netfilter.nf_conntrack_generic_timeout" = 60;
+        "net.netfilter.nf_conntrack_max" = 1048576;
+        "net.netfilter.nf_conntrack_tcp_timeout_established" = 600;
+        "net.netfilter.nf_conntrack_tcp_timeout_time_wait" = 1;
+      };
+    };
+  };
+}

sys/modules/base/networking/tools.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    traceroute
+    mtr
+    tcpdump
+  ];
+
+  programs = {
+    wireshark.enable = true;
+    bandwhich.enable = true;
+  };
+}