mirror of
https://github.com/Nexoniarz/nexoniarz-config-nixos.git
synced 2026-11-03 20:44:27 +00:00
aae40e6d5c
system.nix had grown to 200 lines covering boot, networking, locale, audio, Bluetooth, fonts, nix settings, hardening, DNS and RGB. Split it by concern into boot.nix, networking.nix, locale.nix, nix-settings.nix, security.nix and audio.nix. Also: - drivers.nix -> hardware.nix, absorbing Bluetooth, the I2C udev rule, OpenRGB and printing - fonts -> desktop.nix - nix-ld and pkgs.file -> apps.nix - the Bottles tmpfiles link -> users.nix, next to services.flatpak The reorganization is behavior-neutral: the dbus-1, system-units, user-units and system-path trees are byte-identical to the previous build once self-referential store paths are normalized, and `nix store diff-closures` against the running system reports exactly one change -- go 1.26.7. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
1.2 KiB
Nix
38 lines
1.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
networking.hostName = "nixos";
|
|
networking.networkmanager.enable = true;
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowPing = true;
|
|
allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
|
|
allowedUDPPortRanges = [ { from = 1714; to = 1764; } ];
|
|
allowedTCPPorts = [ 80 443 ];
|
|
};
|
|
|
|
# DNS-over-TLS via systemd-resolved; NetworkManager defers to it rather
|
|
# than writing its own /etc/resolv.conf.
|
|
networking.nameservers = [ "1.1.1.1#cloudflare-dns.com" "9.9.9.9#dns.quad9.net" ];
|
|
services.resolved = {
|
|
enable = true;
|
|
settings.Resolve = {
|
|
DNSSEC = "allow-downgrade";
|
|
DNSOverTLS = "true";
|
|
};
|
|
};
|
|
networking.networkmanager.dns = "systemd-resolved";
|
|
|
|
# Ethernet stays "stable" (pseudonymous but consistent) so static DHCP
|
|
# reservations on the router keep working; Wi-Fi is fully random.
|
|
networking.networkmanager.wifi.macAddress = "random";
|
|
networking.networkmanager.wifi.scanRandMacAddress = true;
|
|
networking.networkmanager.ethernet.macAddress = "stable";
|
|
|
|
# Disable NetworkManager's periodic captive-portal probe.
|
|
networking.networkmanager.settings.connectivity = {
|
|
uri = "";
|
|
interval = 0;
|
|
};
|
|
}
|