Configuration / tooling collection — Nix flake with a NixOS module, dev shell, and standalone config templates (nftables, WireGuard, NetworkManager, DNS)
Network
OVERVIEW
"Qompass AI Network Tooling": a Nix flake providing a network-security and encryption environment — rage/age/OpenSSL encryption tools, collision-resistant hash utilities (BLAKE3, SHA3-256, SHA-512), NetworkManager, and Unbound DNS-over-TLS — plus standalone nftables, WireGuard, and nmcli material. The flake's `nixosModules.default` hardens kernel sysctls and configures NetworkManager, systemd-resolved, and Unbound with the settings below.
HOW IT WORKS
- 1Clone and bootstrap: `git clone https://github.com/qompassai/network.git`, `cd network`, `chmod +x scripts/nix.sh`, `./scripts/nix.sh` — the script installs Nix if needed, enables flakes/experimental features, writes an optimised `nix.conf`, tests the tools, and drops you into the dev environment.
- 2Or enter the environment later with `nix develop` from the repo directory.
- 3Build just one piece, e.g. `nix build .#hash-utils` then `./result/bin/hash-utils blake3 somefile.txt`, or `nix build .#networkmanager-setup`.
- 4Or run a tool without installing: `nix run github:qompassai/network#hash-utils blake3 myfile.txt`.
- 5On NixOS, import the flake's `nixosModules.default` to apply the sysctl, NetworkManager, resolved, and Unbound settings.
- 6For public Wi-Fi via nmcli: enable NetworkManager, turn the radio on, list networks, and connect.
CONCEPTS
CONFIGURATION
| Option | Default | What it does |
|---|---|---|
boot.kernel.sysctl `net.ipv4.conf.all.accept_redirects` / `send_redirects` (+ default and IPv6 equivalents) | 0 | ICMP redirects disabled on all/default interfaces, IPv4 and IPv6 |
networking.networkmanager.enable | true | NetworkManager enabled by the module |
networking.networkmanager.dns | systemd-resolved | NetworkManager DNS plugin |
networking.networkmanager.wifi.powersave | false | Wi-Fi power saving off |
services.resolved.dnssec | "true" | DNSSEC validation in systemd-resolved |
services.resolved.fallbackDns | ["1.1.1.1", "9.9.9.9"] | Fallback DNS servers |
services.resolved.extraConfig | DNS=127.0.0.1`, `Cache=yes`, `DNSStubListener=yes | Resolved points at the local Unbound |
services.unbound.settings.server.interface | ["127.0.0.1", "::1"] | Unbound listens on loopback only |
services.unbound.settings.server cache-min-ttl / cache-max-ttl | 300 / 14400 | Unbound cache TTL bounds (seconds) |
services.unbound.settings.server hardening | `hide-identity`, `hide-version`, `qname-minimisation`, `prefetch`, `prefetch-key`, `harden-*` all true | Privacy and DNSSEC hardening flags |
services.unbound.settings.forward-zone "." | forward-tls-upstream true; forward-addr `1.1.1.1@853`, `1.0.0.1@853`, `9.9.9.9@853` (+ IPv6) | All queries forwarded over DNS-over-TLS (port 853) |
scripts/nix.sh nix.conf | `experimental-features = nix-command flakes`, `max-jobs` = cores (max 8), substituters cache.nixos.org + nix-community cachix (+ FlakeHub extra) | User Nix configuration written by the bootstrap script |
nftables template `table inet my_filter` chain input | policy drop; accepts established/related, loopback, ICMP/ICMPv6 (rate-limited echo), UDP 51820 (WireGuard), TCP {22, 80, 389, 443, 636, 2375, 2376, 3000, 9001, 9030, 9050, 9051, 11371, 13340, 13342} | Standalone template ruleset — header states it is a template and "nothing here was applied to a live firewall" |
devShells.default packages | age, rage, nix-rage, openssl 3.5, b3sum/rhash, nmap, tcpdump, wireshark-cli, unbound, networkmanager (+ openvpn/openconnect plugins), gnupg, yubikey-manager, etc. | Tools provided in the dev shell (also the default package context for the module's system packages) |
CONTROLS
| Action | Control |
|---|---|
| Bootstrap the environment | `./scripts/nix.sh` (after `git clone` + `chmod +x`) |
| Enter the dev environment | nix develop |
| Build the hash utilities | nix build .#hash-utils |
| Hash a file | ./result/bin/hash-utils blake3 <file>` / `hash-utils sha3-256 <file>` / `hash-utils sha512 <file> |
| Run a tool without installing | nix run github:qompassai/network#hash-utils blake3 myfile.txt |
| Build the user-level NetworkManager setup | nix build .#networkmanager-setup` then `./result/bin/networkmanager-setup |
| Check the configuration | `network-security-check` (package in flake.nix; checks NetworkManager/Unbound activity, DNS resolution, tool versions) |
| Generate a rage key (setup package) | `rage-setup` (package in flake.nix; creates `~/.config/rage/key.txt` via `rage-keygen`) |
| Encrypt a file (example) | rage-keygen -o mykey.txt` then `rage -e -i mykey.txt -o secret.age plaintext.txt |
| Connect to public Wi-Fi | sudo systemctl enable --now NetworkManager`; `nmcli radio wifi on`; `nmcli device wifi list`; `sudo nmcli device wifi connect "YOUR_SSID" password "YOUR_PASSWORD" ifname wlan0 |
NOT COVERED
- `wireguard/quickstart.sh`, `nmcli/quickstart.sh`, `scripts/config.sh`, `etc/NetworkManager/`, and `nftables/monero.nft` exist but were not read in full; only `nftables/nftables.conf` and `nmcli/README.md` were verified among the standalone templates. - `doh/` contains a single file named `doh-client-disabled`; no DNS-over-HTTPS configuration could be sourced from it. - `docs/IP.md` is a generic GitHub Pages custom-domain DNS table, not network-tooling documentation. - The README says the tools are "presented for educational purposes ONLY".
REFERENCES
- RFC 7858 — Specification for DNS over Transport Layer Security (TLS)DNS-over-TLS: the protocol Unbound's forward-tls-upstream setting speaks to 1.1.1.1, 1.0.0.1, and 9.9.9.9 on port 853 in the module.
- WireGuard: Next Generation Kernel Network Tunnel (whitepaper)The WireGuard protocol paper; the repo ships WireGuard material and its nftables template admits WireGuard traffic on UDP 51820.
- nftables wikiThe nftables documentation for the table, chain, and policy model the repo's standalone template ruleset (table inet my_filter, input policy drop) is written in.