Reorganization

modules/networking/adblock.nix

@@ -0,0 +1,71 @@
+{ config, lib, pkgs, ... }:
+let
+  adblockLocalZones = pkgs.stdenv.mkDerivation {
+    name = "unbound-zones-adblock";
+
+    src = (pkgs.fetchFromGitHub {
+      owner = "StevenBlack";
+      repo = "hosts";
+      rev = "3.16.20";
+      sha256 = "sha256-z3VWoF5/evd0n97AmrWgSskaNqVaad0Ex2pn53JHkSk=";
+    } + "/hosts");
+
+    phases = [ "installPhase" ];
+
+    installPhase = ''
+      ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u >  $out
+    '';
+
+  };
+in {
+  services.resolved.enable = false;
+  networking.firewall.allowedTCPPorts = [ 53 ];
+  networking.firewall.allowedUDPPorts = [ 53 ];
+
+  services.unbound = {
+    enable = true;
+    settings = {
+      server = {
+        port = 53;
+        interface = [ "0.0.0.0" "127.0.0.1" ];
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.0.0.0/8 allow"
+          "172.16.0.0/12 allow"
+          "192.168.0.0/16 allow"
+        ];
+
+        include = [ "${adblockLocalZones}" ];
+
+        num-threads = 2;
+        so-reuseport = "yes";
+        hide-identity = "yes";
+        hide-version = "yes";
+        qname-minimisation = "yes";
+        harden-dnssec-stripped = "yes";
+        prefetch = "yes";
+        serve-expired = "yes";
+        rrset-roundrobin = "yes";
+        do-ip6 = "no";
+        do-udp = "yes";
+        do-tcp = "yes";
+      };
+      forward-zone = [{
+        name = ".";
+        forward-tls-upstream = "yes";
+        forward-addr = [
+          "1.1.1.1@853#cloudflare-dns.com"
+          "1.0.0.1@853#cloudflare-dns.com"
+          "8.8.8.8@853#dns.google"
+          "8.8.4.4@853#dns.google"
+        ];
+      }];
+    };
+  };
+
+  networking.resolvconf.enable = false;
+  environment.etc."resolv.conf".text = ''
+    nameserver 127.0.0.1
+    options edns0
+  '';
+}

modules/networking/host.nix

@@ -0,0 +1,36 @@
+# Network host configuration with static IP and Avahi discovery
+{ config, lib, pkgs, ... }: 
+
+{
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+    publish = {
+      enable = true;
+      userServices = true;
+      addresses = true;
+    };
+  };
+
+  networking = {
+    nameservers = config.homelab.networking.nameservers;
+    enableIPv6 = false;
+
+    # Avahi port
+    firewall.allowedUDPPorts = [ 5353 ];
+
+    hostName = "homelab";
+    interfaces.${config.homelab.networking.interface} = {
+      ipv4.addresses = [{
+        address = config.homelab.networking.staticIP;
+        prefixLength = 24;
+      }];
+    };
+
+    defaultGateway = {
+      address = config.homelab.networking.gateway;
+      interface = config.homelab.networking.interface;
+    };
+  };
+}

modules/networking/ssh.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }: {
+  services.openssh.enable = true;
+
+  networking.firewall.allowedTCPPorts = [ 22 ];
+}

modules/networking/vpn-host.nix

@@ -0,0 +1,32 @@
+{ config, lib, pkgs, ... }: {
+  environment.systemPackages = [ pkgs.tailscale ];
+
+  services.tailscale.enable = true;
+
+  systemd.services.tailscale-autoconnect = {
+    description = "Automatic oneshot connection to tailscale";
+
+    after = [ "network-pre.target" "tailscale.service" ];
+    wants = [ "network-pre.target" "tailscale.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig.Type = "oneshot";
+
+    script = with pkgs; ''
+      sleep 2
+
+      status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
+      if [ $status = "Running" ]; then # if so, then do nothing
+        exit 0
+      fi
+
+      ${tailscale}/bin/tailscale up -authkey ${config.age.secrets.tailscale.path}
+    '';
+  };
+
+  networking.firewall = {
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+    allowedTCPPorts = [ 22 ];
+  };
+}