6 files changed, 169 insertions, 0 deletions
diff --git a/modules/system/nixos/networking/default.nix b/modules/system/nixos/networking/default.nix
new file mode 100644
index 0000000..a042411
--- /dev/null
+++ b/modules/system/nixos/networking/default.nix
@@ -0,0 +1,13 @@
+{
+  imports = [
+    ./iwd.nix
+    ./networkmanager.nix
+    ./networkd.nix
+    ./resolved.nix
+  ];
+
+  networking.firewall = {
+    enable = true;
+    checkReversePath = "loose";
+  };
+}
diff --git a/modules/system/nixos/networking/iwd.nix b/modules/system/nixos/networking/iwd.nix
new file mode 100644
index 0000000..eea35d8
--- /dev/null
+++ b/modules/system/nixos/networking/iwd.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network.iwd;
+in
+  lib.mkIf cfg.enable {
+    networking = {
+      wireless.iwd = {
+        enable = true;
+        settings = {
+          General = {
+            EnableNetworkConfiguration = !config.collinux.system.network.networkd.enable;
+            AddressRandomization = "once";
+            AddressRandomizationRange = "full";
+          };
+          Network.NameResolvingService = "systemd"; # either systemd or resolvconf
+        };
+      };
+
+      # Disable default networking stuff
+      dhcpcd.enable = false;
+      useDHCP = false;
+      networkmanager.enable = false;
+    };
+  }
diff --git a/modules/system/nixos/networking/networkd.nix b/modules/system/nixos/networking/networkd.nix
new file mode 100644
index 0000000..37b0908
--- /dev/null
+++ b/modules/system/nixos/networking/networkd.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network.networkd;
+
+  dhcp_enabled = cfg.static == null;
+in
+  lib.mkIf cfg.enable {
+    networking = {
+      wireless =
+        if !config.collinux.system.network.iwd.enable
+        then {
+          enable = true;
+          networks.${cfg.ssid}.pskRaw = "ext:psk";
+          secretsFile = cfg.pskFile;
+        }
+        else {};
+
+      useNetworkd = true;
+
+      # Disable default networking stuff
+      dhcpcd.enable = false;
+      useDHCP = false;
+      networkmanager.enable = false;
+    };
+
+    systemd.network = {
+      enable = true;
+
+      wait-online = {
+        enable = true;
+        ignoredInterfaces = ["docker0"];
+        anyInterface = true;
+      };
+
+      networks."11-lan" = {
+        name = "wl*";
+
+        networkConfig =
+          (
+            if dhcp_enabled
+            then {DHCP = "yes";}
+            else {
+              Address = cfg.static.ip;
+              Gateway = cfg.static.gateway;
+              DHCP = "no";
+              # DNS is managed by systemd-resolved (not specified here)
+            }
+          )
+          // {
+            LinkLocalAddressing = "no";
+          };
+
+        dhcpV4Config.UseDNS = "no";
+        dhcpV6Config.UseDNS = "no";
+      };
+    };
+  }
diff --git a/modules/system/nixos/networking/networkmanager.nix b/modules/system/nixos/networking/networkmanager.nix
new file mode 100644
index 0000000..c2d6dd1
--- /dev/null
+++ b/modules/system/nixos/networking/networkmanager.nix
@@ -0,0 +1,18 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network.networkmanager;
+in
+  lib.mkIf cfg.enable {
+    networking = {
+      networkmanager = {
+        enable = true;
+        dns = "systemd-resolved";
+        dhcp = "internal";
+      };
+
+      dhcpcd.enable = false;
+    };
+  }
diff --git a/modules/system/nixos/networking/resolved.nix b/modules/system/nixos/networking/resolved.nix
new file mode 100644
index 0000000..03333b1
--- /dev/null
+++ b/modules/system/nixos/networking/resolved.nix
@@ -0,0 +1,18 @@
+{
+  networking.resolvconf.enable = false;
+
+  networking.nameservers = [
+    "9.9.9.9#dns.quad9.net"
+    "149.112.112.112#dns.quad9.net"
+  ];
+
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
+
+    # disable extra stuff
+    llmnr = "false";
+    extraConfig = "MulticastDNS=no";
+  };
+}
diff --git a/modules/system/nixos/networking/tailscale.nix b/modules/system/nixos/networking/tailscale.nix
new file mode 100644
index 0000000..552ec8b
--- /dev/null
+++ b/modules/system/nixos/networking/tailscale.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.network.tailscale;
+in
+  lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = "both";
+    };
+
+    networking.firewall = {
+      trustedInterfaces = ["tailscale0"];
+      allowedUDPPorts = [config.services.tailscale.port];
+    };
+
+    systemd.services."tailscaled" =
+      if config.collinux.services.selfhost.headscale.enable
+      then {
+        # don't start tailscale until after headscale starts
+        wants = lib.mkForce ["network.target" "headscale.target"];
+        after = lib.mkForce ["network.target" "headscale.target"];
+      }
+      else {
+        wants = lib.mkForce ["network.target"];
+        after = lib.mkForce ["network.target"];
+      };
+
+    environment.systemPackages = [pkgs.tailscale];
+  }