Tuning/refactoring/etc

hosts/common/boot.nix

@@ -1,23 +1,29 @@
 { config, lib, pkgs, ... }: {
   # Common boot configuration
   boot = {
-    loader = {
-      systemd-boot = {
-        enable = true;
-        configurationLimit = 10;
+    binfmt.emulatedSystems = lib.optionals (pkgs.stdenv.hostPlatform.system != "aarch64-linux") [ "aarch64-linux" ];
+    loader =
+      if config.system != "aarch64-linux"
+      then {
+        systemd-boot = {enable = true;};
+        efi = {
+          canTouchEfiVariables = true;
+          efiSysMountPoint = "/boot";
+        };
+      }
+      else {
+        grub.enable = false;
+        generic-extlinux-compatible.enable = true;
       };
-      efi.canTouchEfiVariables = true;
-      timeout = 3;
-    };
 
     # Plymouth for boot splash
     plymouth.enable = true;
 
     # Kernel parameters
-    kernelParams = ["quiet" "splash"];
+    kernel = {sysctl = {"vm.swappiness" = 10;};};
 
     # Console settings
     consoleLogLevel = 0;
     initrd.verbose = false;
   };
-}
+}

hosts/common/default.nix

@@ -0,0 +1,15 @@
+{
+  pkgs,
+  inputs,
+  osConfig,
+  config,
+  ...
+}: {
+  imports = [
+    ./boot.nix
+    ./networking.nix
+    # ./tailscale.nix
+    ./upgrade-diff.nix
+  ];
+
+}

hosts/common/networking.nix

@@ -5,17 +5,30 @@
     enableIPv6 = true;
     useDHCP = false;
     dhcpcd.enable = false;
-  };
-
-  # Firewall
-  networking.firewall = {
-    enable = true;
-    allowPing = true;
+    firewall = {
+      enable = true;
+      trustedInterfaces = ["tailscale0"];
+      checkReversePath = "loose";
+      allowedUDPPorts = [config.services.tailscale.port];
+      allowedTCPPortRanges = [
+        {
+          from = 1714;
+          to = 1764;
+        }
+      ];
+      allowedUDPPortRanges = [
+        {
+          from = 1714;
+          to = 1764;
+        }
+      ];
+      allowedTCPPorts = [22 80 443];
+    };
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
   };
 
   # DNS
-  networking.nameservers = [
-    "1.1.1.1"
-    "8.8.8.8"
-  ];
-}
+}