From dc6093d91e0ac0ec6dc76fb16c3648afe4cfb502 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Fri, 21 Aug 2026 20:15:34 +0200
Subject: decommission sagittarius o7

---
 hosts/sagittarius/network.nix | 73 -------------------------------------------
 1 file changed, 73 deletions(-)
 delete mode 100644 hosts/sagittarius/network.nix

(limited to 'hosts/sagittarius/network.nix')

diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
deleted file mode 100644
index 8d21275..0000000
--- a/hosts/sagittarius/network.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ flakeRoot, ... }:
-{
-  imports = [ (flakeRoot + /wireguard.nix) ];
-
-  networking = {
-    hostName = "sagittarius";
-    useNetworkd = true;
-    firewall.enable = false;
-    nftables = {
-      enable = true;
-      tables.filter = {
-        enable = true;
-        family = "inet";
-        content = ''
-          	set temp-ports {
-              type inet_proto . inet_service
-              flags interval
-              comment "Temporarily opened ports"
-            }
-
-          	chain rpfilter {
-              type filter hook prerouting priority mangle + 10; policy drop;
-              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
-              fib saddr . mark . iif check exists accept
-              jump rpfilter-allow
-            }
-
-            chain rpfilter-allow {
-            }
-
-            chain prerouting {
-              type filter hook prerouting priority mangle;
-              iifname "wg0" meta mark set 42
-            }
-
-            chain input {
-              type filter hook input priority filter; policy drop;
-              iifname "lo" accept comment "trusted interfaces"
-              icmpv6 type echo-reply accept
-              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
-            }
-
-            chain input-allow {
-              tcp dport { 22, 80, 443 } accept
-              udp dport 51820 accept
-              meta l4proto . th dport @temp-ports accept
-              icmp type echo-request accept comment "allow ping"
-              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
-              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
-
-              iifname "wg0" udp dport 53 accept comment "allow DNS over wireguard"
-            }
-        '';
-      };
-    };
-  };
-
-  systemd.network = {
-    enable = true;
-
-    networks = {
-      "10-wan" = {
-        matchConfig.Name = "enp1s0";
-        networkConfig.DHCP = "ipv4";
-        address = [ "2a01:4f9:c012:c7a7::1/64" ];
-        routes = [ { Gateway = "fe80::1"; } ];
-        # networkConfig = {
-        #   IPv6Forwarding = false;
-        # };
-      };
-    };
-  };
-}
-- 
cgit v1.3.1