routerconfig.nix.example

rec {

  system = {
    hostname = "router";
    username = "user";
    timezone = "";

    initialStateVersion = "24.11";
  };
  
  # The net IDs of the subnets; the host part should
  # NOT be included.
  # Example: 192.168.1
  externalInterfaceSubnetId = "192.168.1";
  internalInterfaceSubnetId = "192.168.1";

  network = {

    # The subnet address followed by the CIDR.
    # Example: 192.168.1.0/24
    internalInterfaceSubnet = "${internalInterfaceSubnetId}.0/24";
    externalInterfaceSubnet = "${externalInterfaceSubnetId}.0/24";

    # The range of IP addresses that can be used in DHCP
    # leases. Make sure that any IP address reservations
    # for computer hosts stay outside of this range.
    # Example: 192.168.1.100 - 192.168.1.200
    dhcpAddressRange = "${internalInterfaceSubnetId}.100 - ${internalInterfaceSubnetId}.200";
    
    # The static IP address of the internal interface
    # used by this router.
    # Example: 192.168.1.2
    routerInternalInterfaceAddress = "${internalInterfaceSubnetId}.2";

    # The static IP address of the external interface
    # used by this router.
    # Example: 192.168.1.2
    routerExternalInterfaceAddress = "${externalInterfaceSubnetId}.2";
    
    # If your home network has another router to which
    # this router will be connected to, set it to
    # the address of that router.
    # Example: 192.168.1.1
    gatewayAddress = "${internalInterfaceSubnetId}.1";

    # The interface used that forwards data to WAN.
    externalInterface = "enp4s0";

    # The interface used by hosts connected to the router for
    # transceiving data. If using an Ethernet to USB adapter,
    # set it to the interface of that adapter. If all your
    # connections are managed via a switch, the internalInterface
    # should probably be the same as the externalInterface.
    internalInterface = "enp4s0";

    # Port forwarding configuration. Specify the LAN IP
    # address of the host you want to open the port for.
    openPorts = [
      # { host = "192.168.1.105" port = 80 }
    ];

  };

  security = {

    macWhitelist = [
      # "ff:ff:ff:ff:ff:ff"
    ];

    macBlacklist = [
      # "ff:ff:ff:ff:ff:ff"
    ];

    hostBlocklist = [
      # "example.com"
    ];

    hostRedirectList = [
      # { host = "example.com"; redirect = "127.0.0.1"; }
    ];

    useMacWhitelist = true;
    useMacBlacklist = true;

    useAutoHostBlocklist = true;
    useHostBlocklist = true;
    useHostRedirectList = true;

    useFirewall = true;

    # Whether to use Sirucata Introsion Detection System
    useIds = true; #
    
    # Whether to use fail2ban service
    preventBruteforceAttack = true;

    useDoasOverSudo = true;
    
    # Whether to replace `rm` command with `trash-cli`
    useTrashOverRm = true;

    monitor = true;
    autoUpdate = true;

    # Whether to keep all the security features
    # force-enabled regardless of the
    # chosen settings.
    # NOTE: will disable port forwarding
    strictMode = true;

  };

  dns = {
    # Nameservers for DNS. Consider using NextDNS
    # alongside encrypted DNS queries:
    # https://nextdns.io
    upstream_recursive_servers = [
    ];
  };

  laptop = {
    suspendAfterClosingLid = false;
  };
}