80 lines
2.0 KiB
Nix
80 lines
2.0 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
latest = import inputs.nixpkgs-latest {
|
|
inherit (pkgs.stdenv.hostPlatform) system;
|
|
config = pkgs.config;
|
|
};
|
|
in
|
|
{
|
|
# NetworkManager owns local DNS on workstations. With dhcpcd (EC2),
|
|
# NixOS wires resolvconf to resolved. Preserve both hosts' existing behavior.
|
|
services.resolved = {
|
|
enable = lib.mkDefault (!config.networking.networkmanager.enable);
|
|
settings.Resolve = {
|
|
LLMNR = false;
|
|
MulticastDNS = false;
|
|
# Do not force public DNS, DNSSEC or DNS-over-TLS over DHCP/VPN policy.
|
|
};
|
|
};
|
|
|
|
# Local, opt-in SOCKS client only. Keep the daemon on the system package pin.
|
|
# No relay/exit, control listener, transparent proxy or host DNS changes.
|
|
services.tor = {
|
|
enable = true;
|
|
openFirewall = false;
|
|
relay.enable = false;
|
|
client = {
|
|
enable = true;
|
|
socksListenAddress = {
|
|
addr = "127.0.0.1";
|
|
port = 9050;
|
|
IsolateDestAddr = true;
|
|
IsolateSOCKSAuth = true;
|
|
};
|
|
};
|
|
settings.ClientOnly = true;
|
|
};
|
|
# The NixOS module enables tor.service at boot and supplies its sandbox/user.
|
|
# Retry even after a clean daemon exit; never exhaust systemd's start limit.
|
|
systemd.services.tor = {
|
|
unitConfig.StartLimitIntervalSec = 0;
|
|
serviceConfig = {
|
|
Restart = lib.mkForce "always";
|
|
RestartSec = "5s";
|
|
};
|
|
};
|
|
|
|
programs.mtr = {
|
|
enable = true;
|
|
package = latest.mtr;
|
|
};
|
|
environment.systemPackages = with latest; [
|
|
wireguard-tools # wg and wg-quick; no interfaces or credentials are configured.
|
|
openvpn
|
|
iperf3
|
|
nmap
|
|
traceroute
|
|
whois
|
|
dnsutils
|
|
tcpdump
|
|
ethtool
|
|
netcat-openbsd
|
|
socat
|
|
fping
|
|
ldns # drill and DNS/DNSSEC inspection utilities.
|
|
torsocks
|
|
proxychains-ng # Opt-in wrappers; no global proxy environment is set.
|
|
doggo
|
|
iftop
|
|
bandwhich
|
|
wireshark-cli # tshark; no capture group/capabilities or daemon.
|
|
];
|
|
# No VPN services, peers, keys, routes or opened firewall ports.
|
|
}
|