blob: 5b8380f84f0893b6bb91856ca464cde326d93d2e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
{
config,
flakeRoot,
...
}:
let
secrets = config.sops.secrets;
in
{
imports = [ (flakeRoot + /wireguard.nix) ];
sops = {
age.keyFile = "/var/lib/sops-nix/key.txt";
secrets."wireless.env" = {
sopsFile = ../../secrets/wireless.env;
format = "dotenv";
reloadUnits = [ "iwd.service" ];
};
};
networking = {
hostName = "underworld";
useNetworkd = true;
firewall.enable = false;
nftables = {
enable = true;
tables.filter = {
enable = true;
family = "inet";
content = ''
set temp-ports {
type inet_proto . inet_service
flags interval
comment "Temporarily opened ports"
}
chain rpfilter {
type filter hook prerouting priority mangle + 10; policy drop;
meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
fib saddr . mark . iif check exists accept
jump rpfilter-allow
}
chain rpfilter-allow {
}
chain prerouting {
type filter hook prerouting priority mangle;
iifname "wg0" meta mark set 42
}
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept comment "trusted interfaces"
icmpv6 type echo-reply accept
ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
}
chain input-allow {
# tcp dport { 22, 80, 443 } accept
udp dport 51820 accept
meta l4proto . th dport @temp-ports accept
icmp type echo-request accept comment "allow ping"
icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4."
ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
}
'';
};
};
};
networking.wireless.iwd-ext = {
enable = true;
secretsEnvFile = secrets."wireless.env".path;
networks = {
"KopsiNet-5" = {
networkType = "psk";
config.Security.Passphrase = "@KOPSINET_PSK@";
};
"Pixel_3169" = {
networkType = "psk";
config.Security.Passphrase = "@PHONE_HOTSPOT_PSK@";
};
"eduroam" = {
networkType = "8021x";
config.Security = {
EAP-Method = "TTLS";
EAP-Identity = "anonymous@tvz.hr";
EAP-TTLS-CACert = "embed:eduroam_ca_cert";
EAP-TTLS-ServerDomainMask = "freeradius.tvz.hr";
EAP-TTLS-Phase2-Method = "Tunneled-PAP";
EAP-TTLS-Phase2-Identity = "mbastaja@tvz.hr";
EAP-TTLS-Phase2-Password = "@EDUROAM_PASS@";
};
config.Settings.AutoConnect = true;
extraConfigLines = ''
[@@pem@@eduroam_ca_cert]
-----BEGIN CERTIFICATE-----
MIIDjzCCAnegAwIBAgIBADANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJIUjEP
MA0GA1UECAwGWmFncmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEj
MCEGA1UEAwwaQ0EgUm9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwHhcNMTcwNzE0MTE1
MzUzWhcNMjcwNzEyMTE1MzUzWjBiMQswCQYDVQQGEwJIUjEPMA0GA1UECAwGWmFn
cmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEjMCEGA1UEAwwaQ0Eg
Um9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQC+/60HDgUIMu3F61a0iihkxoAgGJpbaz8bu9WEaKNURFXMW/9FWIPf
xBQbYr3RFaPdpgTLKwtP8ZcCNqH4QM8bwBirk7gMjeNQfUc0DcC1xj0yCjWTLx7L
CxWzOPI/3QZdjlltV5g1bL0nObBXJTqLpJazfJa+c5rMSjuxeHQtOts4h9cPT+3c
Lc21IF3l0Ck4XjNrYMDuBq0B24ukkwqHkTzp5CyJk1gn4Bsr5RskUsgvbAQBacPd
EjwjzJPlMSMpcZw87e+U22FWuhkDEMf+nKtOPxbDz0P1rdXwtsLyYww3gx/ZjzZy
pnNJJDa+K008GJsOtRCgy1O82rOskHVxAgMBAAGjUDBOMB0GA1UdDgQWBBSJ843O
80eWXlzlc5L2e5NSmJt8VTAfBgNVHSMEGDAWgBSJ843O80eWXlzlc5L2e5NSmJt8
VTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBwrBXWaKBkL3vZBtDs
Ebez/E2vU8OSWt53l8gDgPoWVd66qh3k76IkwcW9OB3JwZpY63ZYTC/J+by4/hZh
f5l2AWjjW5sasXz3HlNUexJomk1llLvDJt/eKuTM/5k3LzgbAhmjhzE7Jh3wZJF5
rKOQ9fN7zJ414EebjkeGSgDosq3ip290vFiBc+heqgdfZsDdyxuIKkJCtYYYI8hP
UcKRfJ4nr8enAVkbbjElc5qF7s2Gz0+0owI7ZV/KaXd2ZGcnh6nRx5OIcDGXNLK9
I87CtgF5KX0AGXEMJeG/Jms9hDdn18SXwxIgG6jX7DlAUsz/PVcwDNxF3RCHvsuy
HoU+
-----END CERTIFICATE-----
'';
};
"Students-TVZ" = {
networkType = "8021x";
config.Security = {
EAP-Method = "PAP";
EAP-Identity = "mbastaja@tvz.hr";
EAP-PAEP-ServerDomainMasl = "freeradius.tvz.hr";
EAP-PEAP-Phase2-Method = "MSCHAPV2";
EAP-PEAP-Phase2-Identity = "mbastaja@tvz.hr";
EAP-PEAP-Phase2-Password = "@EDUROAM_PASS@";
};
};
};
};
}
|
