1 files changed, 186 insertions, 0 deletions
diff --git a/modules/networking.nix b/modules/networking.nix
new file mode 100644
index 0000000..9e4c329
--- /dev/null
+++ b/modules/networking.nix
@@ -0,0 +1,186 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.core.network;
+in
+{
+  options.os.core.network = {
+    enable = lib.mkEnableOption "system-wide networking setup";
+    enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers";
+
+    isVM = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host.";
+    };
+
+    ips = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {
+        bare-metal = "10.0.0.2";
+        opnsense-vm = "10.0.0.1";
+        gateway-vm = "10.0.0.3";
+        auth-vm = "10.0.0.4";
+        database-vm = "10.0.0.5";
+        monitor-vm = "10.0.0.6";
+        media-vm = "10.0.0.7";
+        torrent-vm = "10.0.0.8";
+        storage-vm = "10.0.0.9";
+        web-vm = "10.0.0.10";
+        comm-vm = "10.0.0.11";
+        mail-vm = "10.0.0.12";
+        relay-vm = "10.0.0.13";
+        gameserver-vm = "10.0.0.14";
+      };
+      description = "Central registry of static IP allocations for the cluster.";
+    };
+
+    profile = lib.mkOption {
+      type = lib.types.enum [
+        "client"
+        "server"
+      ];
+      default = "client";
+      description = "Which networking profile configuration to apply";
+    };
+
+    lan = lib.mkOption {
+      description = "Physical Home Local Area Network configuration parameters.";
+      type = lib.types.submodule {
+        options = {
+          ip = lib.mkOption {
+            type = lib.types.str;
+            default = "10.0.0.2";
+            description = "The local static or leased IP assigned to this machine on the home network.";
+          };
+          range = lib.mkOption {
+            type = lib.types.str;
+            default = "10.0.0.0/24";
+            description = "The broader subnet block representing the physical home network.";
+          };
+        };
+      };
+    };
+
+    wg = lib.mkOption {
+      description = "Standard WireGuard VPN tunnel configuration parameters.";
+      type = lib.types.submodule {
+        options = {
+          ip = lib.mkOption {
+            type = lib.types.str;
+            default = "10.3.0.1";
+            description = "The explicit tunnel IP address assigned to this machine's WireGuard interface.";
+          };
+          range = lib.mkOption {
+            type = lib.types.str;
+            default = "10.3.0.0/24";
+            description = "The total addressable IP space assigned to the WireGuard network pool.";
+          };
+        };
+      };
+    };
+
+    hs = lib.mkOption {
+      description = "Headscale mesh overlay network configuration parameters.";
+      type = lib.types.submodule {
+        options = {
+          ip = lib.mkOption {
+            type = lib.types.str;
+            default = "10.4.0.1";
+            description = "The explicit mesh network IP address assigned to this machine via Headscale.";
+          };
+          range = lib.mkOption {
+            type = lib.types.str;
+            default = "10.4.0.0/24";
+            description = "The full mesh overlay allocation subnet block.";
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        services.resolved.enable = true;
+      }
+
+      (lib.mkIf (cfg.profile == "client") {
+        networking.networkmanager = {
+          enable = true;
+          dns = "systemd-resolved";
+          wifi.macAddress = "random";
+          wifi.backend = "iwd";
+          ethernet.macAddress = "random";
+        };
+
+        systemd.services."NetworkManager-wait-online".enable = false;
+
+        environment.systemPackages = [
+          pkgs.impala
+        ];
+      })
+
+      (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) {
+        networking = {
+          firewall.enable = true;
+          nftables.enable = true;
+        };
+      })
+
+      (lib.mkIf (cfg.profile == "server") {
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+        systemd.network = {
+          enable = true;
+          wait-online.enable = lib.mkIf (!cfg.isVM) false;
+
+          netdevs = lib.mkIf (!cfg.isVM) {
+            "10-br-srv" = {
+              netdevConfig = {
+                Name = "br-srv";
+                Kind = "bridge";
+              };
+            };
+          };
+          networks."20-host-management" = {
+            matchConfig.Name = if cfg.isVM then "eth0" else "br-srv";
+            address = [ "${cfg.lan.ip}/24" ];
+            gateway = [ cfg.ips.router ];
+            networkConfig.LinkLocalAddressing = "no";
+          };
+        };
+        boot.kernel.sysctl = {
+          "net.ipv4.ip_nonlocal_bind" = 1;
+          "net.ipv4.ip_forward" = 1;
+        };
+      })
+      (lib.mkIf
+        (
+          cfg.profile == "server"
+          && cfg.enableFirewall
+          && cfg.isVM
+          && config.networking.hostName != "vm2-gateway"
+        )
+        {
+          networking.nftables.enable = true;
+          networking.firewall = {
+            enable = true;
+            extraCommands = ''
+              nft add table ip nat 2>/dev/null || true
+              nft flush table ip nat
+              nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; }
+              nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect
+            '';
+          };
+        }
+      )
+    ]
+  );
+}