magpie/networking: iptables -> nftables

flake.lock

@@ -126,11 +126,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737672001,
-        "narHash": "sha256-YnHJJ19wqmibLQdUeq9xzE6CjrMA568KN/lFPuSVs4I=",
+        "lastModified": 1738574474,
+        "narHash": "sha256-rvyfF49e/k6vkrRTV4ILrWd92W+nmBDfRYZgctOyolQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "035f8c0853c2977b24ffc4d0a42c74f00b182cd8",
+        "rev": "fecfeb86328381268e29e998ddd3ebc70bbd7f7c",
         "type": "github"
       },
       "original": {
@@ -243,11 +243,11 @@
         "nixpkgs-24_11": "nixpkgs-24_11"
       },
       "locked": {
-        "lastModified": 1737201600,
-        "narHash": "sha256-JBh5+g8oQteQdQqbO07dGHBRQo/NGI61JPlTjdfQ1pk=",
+        "lastModified": 1737736848,
+        "narHash": "sha256-VrUfCXBXYV+YmQ2OvVTeML9EnmaPRtH+POrNIcJp6yo=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "ade37b2765032f83d2d4bd50b6204a40a4c05eb4",
+        "rev": "6b425d13f5a9d73cb63973d3609acacef4d1e261",
         "type": "gitlab"
       },
       "original": {
@@ -263,11 +263,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737411508,
-        "narHash": "sha256-j9IdflJwRtqo9WpM0OfAZml47eBblUHGNQTe62OUqTw=",
+        "lastModified": 1738291974,
+        "narHash": "sha256-wkwYJc8cKmmQWUloyS9KwttBnja2ONRuJQDEsmef320=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "015d461c16678fc02a2f405eb453abb509d4e1d4",
+        "rev": "4c1251904d8a08c86ac6bc0d72cc09975e89aef7",
         "type": "github"
       },
       "original": {

flake.nix

@@ -155,6 +155,7 @@
             }
           ];
         };
+
         magpie = nixpkgs.lib.nixosSystem rec {
           system = "aarch64-linux";
           modules = [

home/home.nix

@@ -254,6 +254,7 @@ in
           TMP_FILE=$(${pkgs.coreutils}/bin/mktemp /tmp/.swaylock_ss_XXXXXX.jpg)
           ${lib.getExe pkgs.grim} -t ppm - | ${pkgs.imagemagick}/bin/convert - -blur 0x12 "$TMP_FILE"
           ${lib.getExe pkgs.swaylock} -f -i "$TMP_FILE"
+          ${pkgs.coreutils}/bin/shred "$TMP_FILE"
           ${pkgs.coreutils}/bin/rm "$TMP_FILE"
         '';
       in
@@ -298,14 +299,17 @@ in
           profile.outputs = [
             {
               criteria = "eDP-1";
+              position = "3840,0";
             }
             {
               criteria = "Philips Consumer Electronics Company PHL 272S1 UHB2347026536";
               mode = "1920x1080@74.973Hz";
+              position = "5760,0";
             }
             {
               criteria = "Philips Consumer Electronics Company PHL 272S1 UHB2347026535";
               mode = "1920x1080@74.973Hz";
+              position = "7680,0";
             }
           ];
         }

home/zsh.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 {
   programs.z-lua = {
     enableAliases = true;
@@ -11,13 +11,13 @@
     defaultKeymap = "viins";
 
     shellAliases = {
-      cfind = "cscope -C -R -L1";
+      cfind = "${pkgs.cscope}/bin/cscope -C -R -L1";
       chmod = "chmod -v";
       chown = "chown -v";
       cp = "cp -v";
       rm = "rm -v";
       ip = "ip --color=auto";
-      f = "''$(pay-respects zsh)";
+      f = "''$(${lib.getExe pkgs.pay-respects} zsh)";
     };
 
     history = {
@@ -108,7 +108,7 @@
       zstyle ':completion:*' matcher-list 'm:{a-z}={A-Za-z}'
 
       if [[ -n "$PS1" ]] && [[ -z "$TMUX" ]] && [[ -n "$SSH_CONNECTION" ]]; then
-        TMUX_EXE="${pkgs.tmux}/bin/tmux"
+        TMUX_EXE="${lib.getExe pkgs.tmux}"
         systemd-run --scope --user $TMUX_EXE attach-session -t $USER || systemd-run --scope --user $TMUX_EXE new-session -s $USER
       fi
 

magpie/configuration.nix

@@ -333,24 +333,28 @@
   };
 
   networking.hostName = "magpie";
+  networking.firewall = {
+    nftables.enable = true;
+    enable = true;
+    allowedTCPPorts = [
+      80
+      443
+      587
+      2049
+    ]; # http, mail, mail, nfs
+    allowedUDPPorts = [
+      443
+      51820
+    ]; # mail, wireguard
+    allowPing = true;
+    logRefusedConnections = lib.mkDefault false;
+  };
 
-  networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-    587
-    2049
-  ]; # http, mail, mail, nfs
-  networking.firewall.allowedUDPPorts = [
-    443
-    51820
-  ]; # mail, wireguard
-  networking.firewall.allowPing = true;
-  networking.firewall.logRefusedConnections = lib.mkDefault false;
-
-  networking.nat.enable = true;
-  networking.nat.externalInterface = "enp1s0";
-  networking.nat.internalInterfaces = [ "wg0" ];
+  networking.nat = {
+    enable = true;
+    externalInterface = "enp1s0";
+    internalInterfaces = [ "wg0" ];
+  };
 
   networking.networkmanager.enable = true;
   networking.wireless.enable = false;
@@ -363,11 +367,11 @@
       # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
       # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
       postSetup = ''
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        ${pkgs.nftables}/bin/nft add rule ip nat POSTROUTING oifname "eth0" ip saddr 10.100.0.0/24 counter masquerade
       '';
-      # This undoes the above command
+      # This undoes the above command, TODO fix command below to be more specific
       postShutdown = ''
-        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        ${pkgs.nftables}/bin/nft flush table ip nat
       '';
       privateKeyFile = config.sops.secrets."wg_privkey".path;