Improve networking

nixos-config/default.nix

@@ -24,30 +24,11 @@
     ./desktop
     ./dev.nix
     ./networking
+    ./nix.nix
     ./udev.nix
     ./yubikey.nix
   ];
 
-  nix = {
-    settings = {
-      auto-optimise-store = true;
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
-    };
-
-    gc = {
-      automatic = true;
-      dates = "Thu";
-    };
-  };
-
-  sops = {
-    defaultSopsFile = "/etc/sops/secrets.yaml";
-    validateSopsFiles = false;
-  };
-
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;

nixos-config/hosts/rin/default.nix

@@ -17,6 +17,8 @@
   home-manager.users.tlater = import "${flake-inputs.self}/home-config/hosts/rin.nix";
 
   sops = {
+    defaultSopsFile = "/etc/sops/secrets.yaml";
+    validateSopsFiles = false;
     age.keyFile = "/var/lib/sops/host.age";
     secrets."osquery/enroll" = { };
   };
@@ -38,6 +40,9 @@
 
   users.users.tlater.extraGroups = [ "docker" ];
 
+  # Incompatible with docker
+  networking.nftables.enable = lib.mkForce false;
+
   # Allow docker containers to communicate
   networking.firewall.extraCommands =
     let

nixos-config/hosts/yui/default.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  flake-inputs,
-  ...
-}:
+{ pkgs, flake-inputs, ... }:
 {
   imports = [
     flake-inputs.disko.nixosModules.disko
@@ -18,13 +13,9 @@
     ./disko.nix
 
     ./games.nix
-    ./wireguard.nix
     ./networking.nix
   ];
 
-  sops.secrets.nix-signing = { };
-  nix.settings.secret-key-files = [ config.sops.secrets.nix-signing.path ];
-
   nixpkgs.config.allowUnfreePredicate =
     pkg:
     builtins.elem (pkgs.lib.getName pkg) [
@@ -38,8 +29,6 @@
 
   home-manager.users.tlater = import "${flake-inputs.self}/home-config/hosts/yui.nix";
 
-  sops.age.keyFile = "/var/lib/sops/host.age";
-
   easyNvidia = {
     enable = true;
     withIntegratedGPU = false;

nixos-config/hosts/yui/networking.nix

@@ -5,10 +5,25 @@
     # Allow minecraft for when I'm running a minecraft server
     # locally
     firewall = {
+      enable = true;
+      trustedInterfaces = [ "tailscale0" ];
+
       allowedTCPPorts = [ 25565 ];
       allowedUDPPorts = [ 25565 ];
     };
 
     networkmanager.ensureProfiles.profiles.bond.bond.primary = "eno1";
   };
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    useRoutingFeatures = "client";
+
+    extraUpFlags = [ "--login-server=https://tailscale.tlater.net" ];
+    extraSetFlags = [
+      "--operator=tlater"
+      "--webclient"
+    ];
+  };
 }

nixos-config/networking/default.nix

@@ -7,6 +7,7 @@
   networking = {
     useDHCP = false;
     networkmanager.enable = true;
+    nftables.enable = true;
   };
 
   services.unbound = {

nixos-config/networking/personal.nix

@@ -1,92 +1,33 @@
-{ config, ... }:
 {
-  networking = {
-    nftables.enable = true;
-
-    networkmanager.ensureProfiles = {
-      environmentFiles = [ config.sops.secrets.wireless-env.path ];
-
-      profiles = {
-        bond = {
-          connection = {
-            id = "bond";
-            type = "bond";
-            interface-name = "bond0";
-          };
-
-          bond = {
-            miimon = 100;
-            mode = "active-backup";
-            primary_reselect = "always";
-            fail_over_mac = "active";
-            updelay = 200;
-          };
-
-          ipv4.method = "auto";
-          ipv6 = {
-            addr-gen-mode = "default";
-            method = "auto";
-          };
-        };
-
-        ethernet = {
-          connection = {
-            id = "ethernet";
-            type = "ethernet";
-
-            controller = "bond0";
-            port-type = "bond";
-          };
-        };
-
-        lala = {
-          connection = {
-            id = "lala";
-            type = "wifi";
-
-            controller = "bond0";
-            port-type = "bond";
-
-            autoconnect = true;
-            autoconnect-priority = 101;
-          };
-
-          wifi = {
-            mode = "infrastructure";
-            ssid = "lala";
-          };
-
-          wifi-security = {
-            key-mgmt = "sae";
-            psk = "$PSK_LALA";
-          };
-        };
-
-        mikan = {
-          connection = {
-            id = "mikan";
-            type = "wifi";
+  networking.networkmanager.ensureProfiles.profiles = {
+    bond = {
+      connection = {
+        id = "bond";
+        type = "bond";
+        interface-name = "bond0";
+      };
 
-            controller = "bond0";
-            port-type = "bond";
+      bond = {
+        miimon = 100;
+        mode = "active-backup";
+        primary_reselect = "always";
+        fail_over_mac = "active";
+        updelay = 200;
+      };
 
-            autoconnect = true;
-            autoconnect-priority = 100;
-          };
+      ipv4.method = "auto";
+      ipv6 = {
+        addr-gen-mode = "default";
+        method = "auto";
+      };
+    };
 
-          wifi = {
-            mode = "infrastructure";
-            ssid = "mikan";
-          };
+    ethernet.connection = {
+      id = "ethernet";
+      type = "ethernet";
 
-          wifi-security = {
-            key-mgmt = "sae";
-            psk = "$PSK_MIKAN";
-          };
-        };
-      };
+      controller = "bond0";
+      port-type = "bond";
     };
   };
-
-  sops.secrets.wireless-env = { };
 }

nixos-config/nix.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  nix = {
+    package = pkgs.lixPackageSets.stable.lix;
+
+    settings = {
+      auto-optimise-store = true;
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+
+      secret-key-files = [ "/run/credentials/nix-daemon.service/nix-signing-key" ];
+    };
+
+    gc = {
+      automatic = true;
+      dates = "Thu";
+    };
+  };
+
+  systemd = {
+    tmpfiles.settings."10-credstore" = {
+      "/etc/credstore".d = {
+        user = "root";
+        group = "root";
+        mode = "0700";
+      };
+
+      "/etc/credstore.encrypted".d = {
+        user = "root";
+        group = "root";
+        mode = "0700";
+      };
+    };
+
+    services = {
+      nix-daemon = {
+        after = [ "generate-nix-signing-key.service" ];
+        requires = [ "generate-nix-signing-key.service" ];
+        serviceConfig.LoadCredentialEncrypted = [ "nix-signing-key" ];
+      };
+
+      generate-nix-signing-key = {
+        after = [ "systemd-random-seed.service" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          RuntimeDirectory = "generate-nix-signing-key";
+
+          ExecStart =
+            pkgs.writers.writeNu "generate-nix-signing-key"
+              {
+                makeWrapperArgs = [
+                  "--prefix"
+                  "PATH"
+                  ":"
+                  (lib.makeBinPath [
+                    config.nix.package
+                    config.systemd.package
+                  ])
+                ];
+              }
+              ''
+                cd $env.RUNTIME_DIRECTORY
+
+                if not ('/etc/credstore.encrypted/nix-signing-key' | path exists) {
+                  nix-store --generate-binary-cache-key (uname).nodename key.private key.public
+                  systemd-creds encrypt key.private /etc/credstore.encrypted/nix-signing-key
+                  mv key.public /etc/credstore/nix-signing-cert
+
+                  print 'done'
+                } else {
+                  print 'nothing to be done'
+                }
+              '';
+        };
+      };
+    };
+  };
+}