Initial commit

modules/network/firewall.nix

@@ -0,0 +1,37 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.network.firewall;
+in
+{
+  options.my.network.firewall = {
+    allowedTCPPorts = lib.mkOption {
+      type = lib.types.listOf lib.types.port;
+      default = [ ];
+    };
+
+    allowedUDPPorts = lib.mkOption {
+      type = lib.types.listOf lib.types.port;
+      default = [ ];
+    };
+
+    trustedInterfaces = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+
+    allowPing = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+  };
+
+  config = {
+    networking.firewall = {
+      enable = true;
+      allowedTCPPorts = cfg.allowedTCPPorts;
+      allowedUDPPorts = cfg.allowedUDPPorts;
+      trustedInterfaces = cfg.trustedInterfaces;
+      allowPing = cfg.allowPing;
+    };
+  };
+}

modules/network/networkmanager.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.network.networkmanager;
+in
+{
+  options.my.network.networkmanager = {
+    wifiPowersave = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable Wi-Fi powersave (may reduce performance/latency).";
+    };
+
+    useResolved = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Use systemd-resolved for DNS.";
+    };
+  };
+
+  config = {
+    networking.networkmanager.enable = true;
+
+    networking.networkmanager.wifi.powersave = cfg.wifiPowersave;
+
+    services.resolved.enable = cfg.useResolved;
+  };
+}