pkgs/well-known-ssh-known-hosts: Add ssh.gitlab.gnome.org

"Oh this is where I still used the old wg-clerie module"

docs/mkdocs.yml

@@ -0,0 +1,14 @@
+docs_dir: pages
+site_name: clerie's nixfiles
+repo_url: https://git.clerie.de/clerie/nixfiles
+repo_name: clerie/nixfiles
+edit_uri: src/branch/master/docs/pages/
+
+theme:
+  name: material
+  features:
+    - content.action.edit
+    - navigation.indexes
+    - navigation.tabs
+  palette:
+    primary: deep purple

docs/pages/Options.md

@@ -0,0 +1,3 @@
+# Options
+
+This page is generated on build time.

docs/pages/Packages.md

@@ -0,0 +1,3 @@
+# Packages
+
+This page is generated on build time.

docs/pages/index.md

@@ -0,0 +1,6 @@
+---
+hide:
+  - navigation
+---
+
+# Home

flake.lock

@@ -552,22 +552,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-carbon": {
-      "locked": {
-        "lastModified": 1751206202,
-        "narHash": "sha256-VjK8pEv4cfDpCTh4KW1go98kP25j7KdTNEce342Bh/Y=",
-        "owner": "clerie",
-        "repo": "nixpkgs",
-        "rev": "ac4ac98609c1b30c378458ab7207a9a5b5148457",
-        "type": "github"
-      },
-      "original": {
-        "owner": "clerie",
-        "ref": "clerie/always-setup-netdevs",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs-regression": {
       "locked": {
         "lastModified": 1643052045,
@@ -666,11 +650,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1763283776,
-        "narHash": "sha256-Y7TDFPK4GlqrKrivOcsHG8xSGqQx3A6c+i7novT85Uk=",
+        "lastModified": 1763421233,
+        "narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50a96edd8d0db6cc8db57dab6bb6d6ee1f3dc49a",
+        "rev": "89c2b2330e733d6cdb5eae7b899326930c2c0648",
         "type": "github"
       },
       "original": {
@@ -768,7 +752,6 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_5",
         "nixpkgs-0dc1c7": "nixpkgs-0dc1c7",
-        "nixpkgs-carbon": "nixpkgs-carbon",
         "nurausstieg": "nurausstieg",
         "rainbowrss": "rainbowrss",
         "scan-to-gpg": "scan-to-gpg",

flake.nix

@@ -1,7 +1,6 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-carbon.url = "github:clerie/nixpkgs/clerie/always-setup-netdevs";
     # for etesync-dav
     nixpkgs-0dc1c7.url = "github:NixOS/nixpkgs/0dc1c7294c13f5d1dd6eccab4f75d268d7296efe";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";

hosts/carbon/ppp-ncfttb.nix

@@ -60,4 +60,10 @@
     ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
   '';
 
+  networking.firewall.extraCommands = ''
+    # Reject all IPv4 traffic that tries to enter and leave the PPP tunnel
+    iptables -I INPUT -i ppp-ncfttb -j DROP
+    iptables -I OUTPUT -o ppp-ncfttb -j DROP
+  '';
+
 }

hosts/carbon/wg-clerie.nix

@@ -1,10 +1,10 @@
 { ... }:
 
 {
-  services.wg-clerie = {
-    enable = true;
-    ipv6s = [ "2a01:4f8:c0c:15f1::8111/128" ];
-    ipv4s = [ "10.20.30.111/32" ];
-    defaultViaVPN = false;
-  };
+  # services.wg-clerie = {
+  #   enable = true;
+  #   ipv6s = [ "2a01:4f8:c0c:15f1::8111/128" ];
+  #   ipv4s = [ "10.20.30.111/32" ];
+  #   defaultViaVPN = false;
+  # };
 }

hosts/krypton/android.nix

@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-{
-
-  services.udev.packages = [
-    pkgs.android-udev-rules
-  ];
-
-}

hosts/krypton/configuration.nix

@@ -5,7 +5,6 @@
     [
       ./hardware-configuration.nix
 
-      ./android.nix
       ./backup.nix
       ./etesync-dav.nix
       #./initrd.nix

modules/default.nix

@@ -2,7 +2,6 @@
 
 {
   imports = [
-    ./policyrouting
     ./akne
     ./backup
     ./bijwerken
@@ -14,7 +13,6 @@
     ./nginx-port-forward
     ./nixfiles
     ./update-from-hydra
-    ./wg-clerie
     ./wireguard-initrd
   ];
 }

modules/minecraft-server/default.nix

@@ -42,7 +42,7 @@ let
         default = null;
         description = ''
           Directory to store Minecraft database and other state/data files.
-          When null defaulting to /var/lib/minecraft-server-${name}
+          When null defaulting to /var/lib/minecraft-server-''${name}
         '';
       };
 
@@ -50,7 +50,7 @@ let
         type = types.package;
         default = pkgs.papermc;
         defaultText = "pkgs.papermc";
-        example = literalExample "pkgs.minecraft-server_1_12_2";
+        example = literalExpression "pkgs.minecraft-server_1_12_2";
         description = "Version of minecraft-server to run.";
       };
 

modules/policyrouting/default.nix

@@ -1,50 +0,0 @@
-{ config, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.petabyte.policyrouting;
-
-  ruleOpts = { ... }: {
-    options = {
-      prio = mkOption {
-        type = types.int;
-      };
-      rule = mkOption {
-        type = types.str;
-      };
-    };
-  };
-
-in {
-  options = {
-    petabyte.policyrouting = {
-      enable = mkEnableOption "Declarative Policy-Routing";
-      rules = mkOption {
-        type = with types; listOf (submodule ruleOpts);
-        default = [];
-      };
-      rules6 = mkOption {
-        type = with types; listOf (submodule ruleOpts);
-        default = [];
-      };
-      rules4 = mkOption {
-        type = with types; listOf (submodule ruleOpts);
-        default = [];
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    petabyte.policyrouting.rules = [
-      { rule = "lookup main"; prio = 32000; }
-    ];
-    networking.localCommands = ''
-      set -x
-      ip -6 rule flush
-      ip -4 rule flush
-      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -6 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules6)}
-      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -4 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules4)}
-    '';
-  };
-}

modules/wg-clerie/default.nix

@@ -1,94 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.wg-clerie;
-in
-
-{
-  options = {
-    services.wg-clerie = {
-      enable = mkEnableOption "VPN for public static IP";
-      privateKeyFile = mkOption {
-        type = with types; nullOr str;
-        default = null;
-        description = "Path to file containing private key for wireguard interface";
-      };
-      ipv6s = mkOption {
-        type = with types; listOf str;
-        default = [];
-        description = "IPv6 interface addresses";
-      };
-      ipv4s = mkOption {
-        type = with types; listOf str;
-        default = [];
-        description = "IPv4 interface addresses";
-      };
-      defaultViaVPN = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Use VPN default route for a protocol, if that protocol is unavailable in the underlay";
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    networking.iproute2.enable = true;
-    networking.iproute2.rttablesExtraConfig = ''
-      200 wg-clerie
-    '';
-
-    petabyte.policyrouting = {
-      enable = true;
-      rules6 = (concatMap (ip: [
-        { rule = "from ${ip} lookup wg-clerie"; prio = 19000; }
-        { rule = "from ${ip} unreachable"; prio = 19001; }
-      ]) cfg.ipv6s) ++ [
-        # Do not reach VPN server via VPN
-        { rule = "to 2a01:4f8:c0c:15f1::1/128 ipproto udp dport 51820 lookup main"; prio = 20000; }
-        { rule = "to 2a01:4f8:c0c:15f1::1/128 ipproto udp dport 51820 unreachable"; prio = 20001; }
-        # Try direct routing first, fallback to VPN
-        { rule = "lookup main"; prio = 21000; }
-      ] ++ (if cfg.defaultViaVPN then [
-        { rule = "lookup wg-clerie"; prio = 21001; }
-      ] else []) ++ [
-        { rule = "unreachable"; prio = 22000; }
-      ];
-      rules4 = (concatMap (ip: [
-        { rule = "from ${ip} lookup wg-clerie"; prio = 19000; }
-        { rule = "from ${ip} unreachable"; prio = 19001; }
-      ]) cfg.ipv4s) ++ [
-        # Do not reach VPN server via VPN
-        { rule = "to 78.47.183.82/32 ipproto udp dport 51820 lookup main"; prio = 20000; }
-        { rule = "to 78.47.183.82/32 ipproto udp dport 51820 unreachable"; prio = 20001; }
-        # Try direct routing first, fallback to VPN
-        { rule = "lookup main"; prio = 21000; }
-      ] ++ (if cfg.defaultViaVPN then [
-        { rule = "lookup wg-clerie"; prio = 21001; }
-      ] else []) ++ [
-        { rule = "unreachable"; prio = 22000; }
-      ];
-    };
-
-    networking.wireguard.enable = true;
-    networking.wireguard.interfaces = {
-      wg-clerie = {
-        privateKeyFile = if cfg.privateKeyFile != null then cfg.privateKeyFile else
-          config.sops.secrets.wg-clerie.path;
-        ips = cfg.ipv6s ++ cfg.ipv4s;
-        table = "wg-clerie";
-        peers = [
-          {
-            # Fallback to legacy IP if there is no route to VPN server
-            endpoint = "$(ip route get 2a01:4f8:c0c:15f1::1 ipproto udp dport 51820 &>/dev/null && echo '[2a01:4f8:c0c:15f1::1]:51820' || echo '78.47.183.82:51820')";
-            persistentKeepalive = 25;
-            dynamicEndpointRefreshSeconds = 5;
-            allowedIPs = [ "0.0.0.0/0" "::/0" "10.20.30.0/24" "2a01:4f8:c0c:15f1::/113" ];
-            publicKey = "2p1Jqs3bkXbXHFWE6vp1yxHIFoUaZQEARS2nJzbkuBA=";
-          }
-        ];
-      };
-    };
-  };
-}

pkgs/ds-lite-dhcpcd-hook/ds-lite-dhcpcd-hook.sh

@@ -83,7 +83,7 @@ if TUNNEL_INTERFACE_CONFIG="$(ip --json link show "${TUNNEL_INTERFACE_NAME}")";
 	if [[ "${TUNNEL_INTERFACE_ORIGIN_ADDRESS}" != "${WAN_INTERFACE_ADDRESS}" || "${TUNNEL_INTERFACE_REMOTE_ADDRESS}" != "${AFTR_ADDRESS}" || "${TUNNEL_INTERFACE_OPERSTATE}" != "UNKNOWN" ]]; then
 		log_tunnel "Bad configuration, fixing tunnel parameter"
 
-		ip tunnel change "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}"
+		ip tunnel change "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}" encaplimit none
 		ip link set "$TUNNEL_INTERFACE_NAME" up
 	else
 		log_tunnel "Tunnel already configured"
@@ -91,7 +91,7 @@ if TUNNEL_INTERFACE_CONFIG="$(ip --json link show "${TUNNEL_INTERFACE_NAME}")";
 else
 	log_tunnel "Setting up DS-Lite tunnel"
 
-	ip tunnel add "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}"
+	ip tunnel add "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}" encaplimit none
 	ip link set "$TUNNEL_INTERFACE_NAME" up
 fi
 

pkgs/nixfiles-docs-generate-options-md/default.nix

@@ -0,0 +1,8 @@
+{
+  pkgs,
+}:
+
+pkgs.clerie-build-support.writePythonScript {
+  name = "nixfiles-docs-generate-options-md";
+  text = builtins.readFile ./nixfiles-docs-generate-options-md.py;
+}

pkgs/nixfiles-docs-generate-options-md/nixfiles-docs-generate-options-md.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+
+import argparse
+import json
+from pathlib import Path
+
+parser = argparse.ArgumentParser(prog="generate-options-docs.py")
+parser.add_argument("options_json_file", type=Path)
+
+args = parser.parse_args()
+
+module_options = json.loads(args.options_json_file.read_text())
+
+print("""---
+hide:
+  - navigation
+---
+
+# Options
+
+""")
+
+def format_option_value(option_value):
+    if not isinstance(option_value, dict):
+        option_value = {
+                "_type": "literalExpression",
+                "text": str(option_value),
+        }
+
+    match option_value["_type"]:
+        case "literalExpression":
+            if "\n" in option_value["text"]:
+                return f"```\n{option_value['text']}\n```"
+            else:
+                return f"```\n{option_value['text']}\n```"
+
+        case "literalMD":
+            return option_value["text"]
+        case other_value_type:
+            raise Exception(f"Unhandle option value type {other_value_type}")
+
+
+def print_option(option):
+    print(f"## `{option['name']}`")
+    print("")
+    if "description" in option and option["description"] is not None:
+        print(option['description'])
+        print("")
+    if "type" in option:
+        print("**Type:**")
+        print(f"`{option['type']}`")
+        print("")
+    if "default" in option:
+        print(f"**Default:**")
+        print(format_option_value(option['default']))
+        print("")
+    if "example" in option:
+        print(f"**Example:**")
+        print(format_option_value(option['example']))
+        print("")
+
+for option in module_options:
+    print_option(option)

pkgs/nixfiles-docs-generate-pkgs-md/default.nix

@@ -0,0 +1,8 @@
+{
+  pkgs,
+}:
+
+pkgs.clerie-build-support.writePythonScript {
+  name = "nixfiles-docs-generate-pkgs-md";
+  text = builtins.readFile ./nixfiles-docs-generate-pkgs-md.py;
+}

pkgs/nixfiles-docs-generate-pkgs-md/nixfiles-docs-generate-pkgs-md.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+
+import argparse
+import json
+from pathlib import Path
+
+parser = argparse.ArgumentParser(prog="generate-pkgs-docs.py")
+parser.add_argument("pkgs_json_file", type=Path)
+
+args = parser.parse_args()
+
+packages = json.loads(args.pkgs_json_file.read_text())
+
+print("""---
+hide:
+  - navigation
+---
+
+# Packages
+
+""")
+
+for package in packages:
+    print(f"## {package['name']}")
+    print("")
+    print("* Build status: "
+          f"[x86_64-linux](https://hydra.clerie.de/job/nixfiles/nixfiles/packages.x86_64-linux.{package['name']}) | "
+          f"[aarch64-linux](https://hydra.clerie.de/job/nixfiles/nixfiles/packages.aarch64-linux.{package['name']})"
+          )
+    print("")

pkgs/nixfiles-docs-options/default.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  writeText,
+  ...
+}:
+
+let
+  evaluatedModules = lib.evalModules {
+    modules = [
+      ../../modules
+      ../../profiles
+      {
+        _module.check = false;
+      }
+    ];
+  };
+
+in
+
+writeText "options.json" (
+  builtins.toJSON (
+    lib.filter (opt: !opt.internal && !(lib.head opt.loc == "_module")) (
+      lib.optionAttrSetToDocList evaluatedModules.options
+    )
+  )
+)

pkgs/nixfiles-docs-pkgs/default.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  pkgs,
+  writeText,
+}:
+
+let
+
+  pkgNames = builtins.filter (attrName: attrName != "nixfiles-docs-pkgs") (builtins.attrNames (import ../../pkgs/overlay.nix null null));
+  pkgsDocs = builtins.map (pkgName: {
+    name = pkgName;
+    meta = pkgs."${pkgName}".meta;
+  }) pkgNames;
+
+in
+
+writeText "pkgs.json" (
+  builtins.toJSON pkgsDocs
+)

pkgs/nixfiles-docs/default.nix

@@ -0,0 +1,35 @@
+{
+  stdenv,
+  mkdocs-material,
+  nixfiles-docs-generate-options-md,
+  nixfiles-docs-generate-pkgs-md,
+  nixfiles-docs-options,
+  nixfiles-docs-pkgs,
+}:
+
+stdenv.mkDerivation {
+  name = "nixfiles-docs";
+
+  src = ../../docs;
+
+  buildInputs = [
+    mkdocs-material
+    nixfiles-docs-generate-options-md
+    nixfiles-docs-generate-pkgs-md
+  ];
+
+  buildPhase = ''
+    nixfiles-docs-generate-options-md ${nixfiles-docs-options} > pages/Options.md
+    nixfiles-docs-generate-pkgs-md ${nixfiles-docs-pkgs} > pages/Packages.md
+    python3 -m mkdocs build
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r ./site/* $out/
+
+    mkdir -p $out/nix-support
+    echo "doc manual $out" >> $out/nix-support/hydra-build-products
+  '';
+}
+

pkgs/overlay.nix

@@ -27,6 +27,11 @@ final: prev: {
   "http.server" = final.callPackage ./http.server {};
   nix-remove-result-links = final.callPackage ./nix-remove-result-links {};
   nixfiles-auto-install = final.callPackage ./nixfiles/nixfiles-auto-install.nix {};
+  nixfiles-docs = final.python3.pkgs.callPackage ./nixfiles-docs {};
+  nixfiles-docs-generate-pkgs-md = final.callPackage ./nixfiles-docs-generate-pkgs-md {};
+  nixfiles-docs-generate-options-md = final.callPackage ./nixfiles-docs-generate-options-md {};
+  nixfiles-docs-pkgs = final.callPackage ./nixfiles-docs-pkgs {};
+  nixfiles-docs-options = final.callPackage ./nixfiles-docs-options {};
   nixfiles-generate-config = final.callPackage ./nixfiles/nixfiles-generate-config.nix {};
   nixfiles-generate-backup-secrets = final.callPackage ./nixfiles/nixfiles-generate-backup-secrets.nix {};
   nixfiles-update-ssh-host-keys = final.callPackage ./nixfiles/nixfiles-update-ssh-host-keys.nix {};

pkgs/well-known-ssh-known-hosts/well-known-ssh-known-hosts

@@ -28,3 +28,12 @@ codeberg.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
 codeberg.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8hZi7K1/2E2uBX8gwPRJAHvRAob+3Sn+y2hxiEhN0buv1igjYFTgFO2qQD8vLfU/HT/P/rqvEeTvaDfY1y/vcvQ8+YuUYyTwE2UaVU5aJv89y6PEZBYycaJCPdGIfZlLMmjilh/Sk8IWSEK6dQr+g686lu5cSWrFW60ixWpHpEVB26eRWin3lKYWSQGMwwKv4LwmW3ouqqs4Z4vsqRFqXJ/eCi3yhpT+nOjljXvZKiYTpYajqUC48IHAxTWugrKe1vXWOPxVXXMQEPsaIRc2hpK+v1LmfB7GnEGvF1UAKnEZbUuiD9PBEeD5a1MZQIzcoPWCrTxipEpuXQ5Tni4mN
 # SHA256:mIlxA9k46MmM6qdJOdMnAQpzGxF4WIVVL+fj+wZbw0g
 codeberg.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB
+
+# Gnome Gitlab
+# From: ssh-keyscan ssh.gitlab.gnome.org
+# SHA256:WRRpoWo7szMzwlkYFeLoj0UItmVHfAI+r+hFgzwGARg
+ssh.gitlab.gnome.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCmUnZ33O26kvhcmc6k1T8xlL3yJjeNt3gphvW9/5u/CO0z5G8PGr2km4jUhStuPJR9m77LrdCF5Ywm26hsBnoxK+1zMs7YTjriiGt4r0Q5btQS5J5zFAV6aYJEmCbQz/23n8+w9Jx3hPVS8A3VE9Vd52S+5DMeIQY8QR3LPpROyCIpkR425sN0D0VjRUAH0hn61zS8N1+Pw5te2ULbBriBB9cub2n1GBCsZ2ErX1ernwKffOz/fbi5mpGbGLlJabLBm81/AiNk6NLZWTAZiNZjztxRySZFSpSzGF54kttIePxNC1x9AtW4KMaIzjVK2DIrFONyZYiEX47ox5TXlc7VQaBICUoTrR91wpb5xl2HPKP4MvFqUAzubU2V8r91ISXrnJyfwDrSB7L9Jwg6B6pN+acIttC4gOFGTJg9qanmLxtonSpwv/NaLehI1+D4LR9Or+e8jjtKSc6vu8+ghqAni3XHoT9uSmt1UPd89dOhqbpk8Hc3KTubUC3WIjGnotE=
+# SHA256:TiA9po6nO6jFso7wQNy4xLlth10lIfjv1dxuDabVIqw
+ssh.gitlab.gnome.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH8NuGQ3ArFGochlv6TKXhMhsgIwG743e93pLkAQTzfgds0g0k6QBimb40zavVjITjytiSaQsf+KncJgUjYd98o=
+# SHA256:Y9G4dWiIfi53LR3InJWsIbv4lekUHonq/HrqTTm/rcw
+ssh.gitlab.gnome.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG6b3deoYMPwKEu9Sj+y6MBHYYUKQiAnta/go3aNv7R

profiles/desktop/fonts.nix

@@ -11,7 +11,7 @@ with lib;
       roboto
       roboto-mono
       noto-fonts
-      noto-fonts-emoji
+      noto-fonts-color-emoji
       comfortaa
     ] ++ (if pkgs ? "noto-fonts-cjk-sans" then [ pkgs.noto-fonts-cjk-sans ] else [ pkgs.noto-fonts-cjk ]);
 

profiles/desktop/power.nix

@@ -8,7 +8,7 @@ with lib;
 
     boot.resumeDevice = lib.optionalString ((lib.length config.swapDevices) > 0) (lib.head config.swapDevices).device;
     services.logind = {
-      lidSwitch = "suspend-then-hibernate";
+      settings.Login.HandleLidSwitch = "suspend-then-hibernate";
     };
     systemd.sleep.extraConfig = ''
       HibernateDelaySec=30m

profiles/firefox/default.nix

@@ -12,8 +12,6 @@ with lib;
 
     programs.firefox.enable = true;
 
-    programs.firefox.package = pkgs.firefox-wayland;
-
     programs.firefox.policies = {
       AutofillAddressEnabled = false;
       AutofillCreditCardEnabled = false;

profiles/router/default.nix

@@ -11,8 +11,10 @@ with lib;
   config = mkIf config.profiles.clerie.router.enable {
 
     environment.systemPackages = with pkgs; [
-      wireguard-tools
+      conntrack-tools
+      iptstate # show conntrack table
       tcpdump
+      wireguard-tools
     ];
   
     boot.kernel.sysctl = {