7 files changed, 216 insertions, 0 deletions
diff --git a/modules/networking/nixos/default.nix b/modules/networking/nixos/default.nix
new file mode 100644
index 0000000..f869670
--- /dev/null
+++ b/modules/networking/nixos/default.nix
@@ -0,0 +1,22 @@
+{
+  imports = [
+    ./resolved.nix
+    ./unbound.nix
+    ./networkd.nix
+    ./iwd.nix
+    ./wpasupplicant.nix
+  ];
+
+  networking = {
+    firewall = {
+      enable = true;
+      checkReversePath = "loose";
+    };
+
+    # Disable default networking stuff
+    resolvconf.enable = false;
+    dhcpcd.enable = false;
+    useDHCP = false;
+    networkmanager.enable = false;
+  };
+}
diff --git a/modules/networking/nixos/iwd.nix b/modules/networking/nixos/iwd.nix
new file mode 100644
index 0000000..0c5bdfa
--- /dev/null
+++ b/modules/networking/nixos/iwd.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network;
+  enabled = cfg.wireless.dynamic;
+in
+  lib.mkIf enabled {
+    networking = {
+      wireless.iwd = {
+        enable = true;
+        settings = {
+          General = {
+            EnableNetworkConfiguration = false; # always let networkd handle this
+            AddressRandomization = "once";
+            AddressRandomizationRange = "full";
+          };
+          Network.NameResolvingService = "systemd"; # either systemd or resolvconf
+        };
+      };
+    };
+  }
diff --git a/modules/networking/nixos/networkd.nix b/modules/networking/nixos/networkd.nix
new file mode 100644
index 0000000..2c7f580
--- /dev/null
+++ b/modules/networking/nixos/networkd.nix
@@ -0,0 +1,44 @@
+{
+  # lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network;
+  dhcp_enabled = cfg.static == null;
+
+  device =
+    if (cfg.wireless == null)
+    then "eth0"
+    else "wl*";
+in {
+  networking.useNetworkd = true;
+  systemd.network = {
+    enable = true;
+
+    wait-online = {
+      enable = true;
+      ignoredInterfaces = ["docker0"];
+      anyInterface = true;
+    };
+
+    networks."11-default" =
+      if dhcp_enabled
+      then {
+        name = device;
+        networkConfig.DHCP = "yes";
+
+        # never accept dhcp dns
+        dhcpV4Config.UseDNS = "no";
+        dhcpV6Config.UseDNS = "no";
+      }
+      else {
+        name = device;
+        networkConfig = {
+          Address = cfg.static.ip;
+          Gateway = cfg.static.gateway;
+          DHCP = "no";
+          # DNS is managed by systemd-resolved (not specified here)
+        };
+      };
+  };
+}
diff --git a/modules/networking/nixos/resolved.nix b/modules/networking/nixos/resolved.nix
new file mode 100644
index 0000000..01e75e2
--- /dev/null
+++ b/modules/networking/nixos/resolved.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.network.dns;
+in
+  lib.mkIf (!cfg.areYouAServer) {
+    networking.nameservers = [
+      "9.9.9.9#dns.quad9.net"
+      "149.112.112.112#dns.quad9.net"
+    ];
+
+    services.resolved = {
+      enable = true;
+      settings.Resolve = {
+        DNSOverTLS = true;
+        DNSSEC = "allow-downgrade";
+
+        LLMNR = false;
+        MulticastDNS = false;
+      };
+    };
+  }
diff --git a/modules/networking/nixos/unbound.nix b/modules/networking/nixos/unbound.nix
new file mode 100644
index 0000000..b8b1e0b
--- /dev/null
+++ b/modules/networking/nixos/unbound.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.network.dns;
+in
+  lib.mkIf cfg.areYouAServer {
+    networking = {
+      nameservers = ["127.0.0.1"];
+      resolvconf.enable = lib.mkForce true; # we disabled this earlier
+    };
+    services.resolved.enable = false;
+
+    services.unbound = {
+      enable = true;
+      settings.server = {
+        interface = ["0.0.0.0"];
+        port = 53;
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.100.0.0/24 allow"
+          "0.0.0.0/0 refuse"
+        ];
+
+        local-zone = [''"ganymede." redirect''];
+        local-data = [''"ganymede. IN A 10.100.0.1"''];
+      };
+    };
+  }
diff --git a/modules/networking/nixos/wpasupplicant.nix b/modules/networking/nixos/wpasupplicant.nix
new file mode 100644
index 0000000..8314095
--- /dev/null
+++ b/modules/networking/nixos/wpasupplicant.nix
@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.network.wireless;
+  enabled = cfg.static != null;
+in
+  lib.mkIf enabled {
+    networking.wireless = {
+      enable = true;
+      networks.${cfg.static.ssid}.pskRaw = "ext:psk";
+      secretsFile = cfg.static.pskFile;
+    };
+  }
diff --git a/modules/networking/options.nix b/modules/networking/options.nix
new file mode 100644
index 0000000..cc4864b
--- /dev/null
+++ b/modules/networking/options.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  my-lib,
+  ...
+}: let
+  inherit (my-lib.netTypes {inherit lib;}) ipAddr ipAddrCidr;
+  inherit (lib) mkOption mkEnableOption;
+in {
+  options.collinux.system.network = {
+    dns.areYouAServer = mkEnableOption "Set up unbound with the *.ganymede resolver and disable resolved stub";
+
+    static = lib.mkOption {
+      description = "Set a static IP address for this device on this network. Leave unset to use DHCP";
+      type = lib.types.nullOr (lib.types.submodule {
+        options = {
+          ip = mkOption {
+            description = "IP address";
+            type = ipAddrCidr;
+          };
+          gateway = mkOption {
+            description = "default gateway";
+            type = ipAddr;
+          };
+        };
+      });
+      default = null;
+    };
+
+    wireless = {
+      static = lib.mkOption {
+        description = "Set a preconfigured SSID and PSK for the wireless config";
+        type = lib.types.nullOr (lib.types.submodule {
+          options = {
+            ssid = mkOption {
+              description = "SSID for this network";
+              type = lib.types.str;
+            };
+            pskFile = mkOption {
+              description = "Absolute path to a file containing the pre-shared key for this network in the form `psk:<wifi psk>`";
+              type = lib.types.str;
+              example = "/run/secrets.d/wifi-psk";
+            };
+          };
+        });
+        default = null;
+      };
+      dynamic = mkEnableOption "Enable dynamically joining wireless networks with iwd";
+    };
+
+    wireguard = {
+      enable = mkEnableOption "Whether to enable Wireguard on this device";
+      # peers = lib.types.listOf (lib.types.submodule {
+      #   options = {
+      #   };
+      # });
+    };
+  };
+}