1 files changed, 135 insertions, 0 deletions
diff --git a/hosts/underworld/network.nix b/hosts/underworld/network.nix
new file mode 100644
index 0000000..5b8380f
--- /dev/null
+++ b/hosts/underworld/network.nix
@@ -0,0 +1,135 @@
+{
+  config,
+  flakeRoot,
+  ...
+}:
+let
+  secrets = config.sops.secrets;
+in
+{
+  imports = [ (flakeRoot + /wireguard.nix) ];
+
+  sops = {
+    age.keyFile = "/var/lib/sops-nix/key.txt";
+    secrets."wireless.env" = {
+      sopsFile = ../../secrets/wireless.env;
+      format = "dotenv";
+      reloadUnits = [ "iwd.service" ];
+    };
+  };
+
+  networking = {
+    hostName = "underworld";
+    useNetworkd = true;
+    firewall.enable = false;
+    nftables = {
+      enable = true;
+      tables.filter = {
+        enable = true;
+        family = "inet";
+        content = ''
+          	set temp-ports {
+              type inet_proto . inet_service
+              flags interval
+              comment "Temporarily opened ports"
+            }
+
+          	chain rpfilter {
+              type filter hook prerouting priority mangle + 10; policy drop;
+              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
+              fib saddr . mark . iif check exists accept
+              jump rpfilter-allow
+            }
+
+            chain rpfilter-allow {
+            }
+
+            chain prerouting {
+              type filter hook prerouting priority mangle;
+              iifname "wg0" meta mark set 42
+            }
+
+            chain input {
+              type filter hook input priority filter; policy drop;
+              iifname "lo" accept comment "trusted interfaces"
+              icmpv6 type echo-reply accept
+              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
+            }
+
+            chain input-allow {
+              # tcp dport { 22, 80, 443 } accept
+              udp dport 51820 accept
+              meta l4proto . th dport @temp-ports accept
+              icmp type echo-request accept comment "allow ping"
+              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
+              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
+            }
+        '';
+      };
+    };
+  };
+
+  networking.wireless.iwd-ext = {
+    enable = true;
+    secretsEnvFile = secrets."wireless.env".path;
+    networks = {
+      "KopsiNet-5" = {
+        networkType = "psk";
+        config.Security.Passphrase = "@KOPSINET_PSK@";
+      };
+      "Pixel_3169" = {
+        networkType = "psk";
+        config.Security.Passphrase = "@PHONE_HOTSPOT_PSK@";
+      };
+      "eduroam" = {
+        networkType = "8021x";
+        config.Security = {
+          EAP-Method = "TTLS";
+          EAP-Identity = "anonymous@tvz.hr";
+          EAP-TTLS-CACert = "embed:eduroam_ca_cert";
+          EAP-TTLS-ServerDomainMask = "freeradius.tvz.hr";
+          EAP-TTLS-Phase2-Method = "Tunneled-PAP";
+          EAP-TTLS-Phase2-Identity = "mbastaja@tvz.hr";
+          EAP-TTLS-Phase2-Password = "@EDUROAM_PASS@";
+        };
+        config.Settings.AutoConnect = true;
+        extraConfigLines = ''
+          [@@pem@@eduroam_ca_cert]
+          -----BEGIN CERTIFICATE-----
+          MIIDjzCCAnegAwIBAgIBADANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJIUjEP
+          MA0GA1UECAwGWmFncmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEj
+          MCEGA1UEAwwaQ0EgUm9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwHhcNMTcwNzE0MTE1
+          MzUzWhcNMjcwNzEyMTE1MzUzWjBiMQswCQYDVQQGEwJIUjEPMA0GA1UECAwGWmFn
+          cmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEjMCEGA1UEAwwaQ0Eg
+          Um9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+          ggEKAoIBAQC+/60HDgUIMu3F61a0iihkxoAgGJpbaz8bu9WEaKNURFXMW/9FWIPf
+          xBQbYr3RFaPdpgTLKwtP8ZcCNqH4QM8bwBirk7gMjeNQfUc0DcC1xj0yCjWTLx7L
+          CxWzOPI/3QZdjlltV5g1bL0nObBXJTqLpJazfJa+c5rMSjuxeHQtOts4h9cPT+3c
+          Lc21IF3l0Ck4XjNrYMDuBq0B24ukkwqHkTzp5CyJk1gn4Bsr5RskUsgvbAQBacPd
+          EjwjzJPlMSMpcZw87e+U22FWuhkDEMf+nKtOPxbDz0P1rdXwtsLyYww3gx/ZjzZy
+          pnNJJDa+K008GJsOtRCgy1O82rOskHVxAgMBAAGjUDBOMB0GA1UdDgQWBBSJ843O
+          80eWXlzlc5L2e5NSmJt8VTAfBgNVHSMEGDAWgBSJ843O80eWXlzlc5L2e5NSmJt8
+          VTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBwrBXWaKBkL3vZBtDs
+          Ebez/E2vU8OSWt53l8gDgPoWVd66qh3k76IkwcW9OB3JwZpY63ZYTC/J+by4/hZh
+          f5l2AWjjW5sasXz3HlNUexJomk1llLvDJt/eKuTM/5k3LzgbAhmjhzE7Jh3wZJF5
+          rKOQ9fN7zJ414EebjkeGSgDosq3ip290vFiBc+heqgdfZsDdyxuIKkJCtYYYI8hP
+          UcKRfJ4nr8enAVkbbjElc5qF7s2Gz0+0owI7ZV/KaXd2ZGcnh6nRx5OIcDGXNLK9
+          I87CtgF5KX0AGXEMJeG/Jms9hDdn18SXwxIgG6jX7DlAUsz/PVcwDNxF3RCHvsuy
+          HoU+
+          -----END CERTIFICATE-----
+        '';
+      };
+      "Students-TVZ" = {
+        networkType = "8021x";
+        config.Security = {
+          EAP-Method = "PAP";
+          EAP-Identity = "mbastaja@tvz.hr";
+          EAP-PAEP-ServerDomainMasl = "freeradius.tvz.hr";
+          EAP-PEAP-Phase2-Method = "MSCHAPV2";
+          EAP-PEAP-Phase2-Identity = "mbastaja@tvz.hr";
+          EAP-PEAP-Phase2-Password = "@EDUROAM_PASS@";
+        };
+      };
+    };
+  };
+}