machines/heimdall/configuration.nix

@@ -31,49 +31,42 @@
     hostName = "heimdall";
     domain = "datarift.nl";
 
+    nameservers = [ "8.8.8.8" ];
+    defaultGateway = "172.31.1.1";
+    defaultGateway6 = {
+      address = "fe80::1";
+      interface = "eth0";
+    };
+    dhcpcd.enable = false;
     usePredictableInterfaceNames = lib.mkForce false;
-    useDHCP = false;
+    interfaces = {
-    networkmanager.enable = false;
+      eth0 = {
-    useNetworkd = true;
+        ipv4.addresses = [
-    firewall.trustedInterfaces = [ "tailscale0" ];
-  };
-
-  systemd.network = {
-    enable = true;
-
-    networks = {
-      "40-eth0" = {
-        matchConfig = {
-          Name = "eth0";
-        };
-
-        networkConfig = {
-          Address = [
-            "159.69.211.175/32"
-            "2a01:4f8:1c1e:5fb2::1/64"
-            "fe80::9400:2ff:fe12:a2eb/64"
-          ];
-          DHCP = "no";
-          Gateway = [
-            "172.31.1.1"
-            "fe80::1"
-          ];
-        };
-
-        routes = [
           {
-            routeConfig = {
+            address = "159.69.211.175";
-              Destination = "172.31.1.1/32";
+            prefixLength = 32;
-              Scope = "link";
+          }
-              Protocol = "static";
+        ];
-            };
+        ipv6.addresses = [
+          {
+            address = "2a01:4f8:1c1e:5fb2::1";
+            prefixLength = 64;
           }
           {
-            routeConfig = {
+            address = "fe80::9400:2ff:fe12:a2eb";
-              Destination = "fe80::1/128";
+            prefixLength = 64;
-              Scope = "link";
+          }
-              Protocol = "static";
+        ];
-            };
+        ipv4.routes = [
+          {
+            address = "172.31.1.1";
+            prefixLength = 32;
+          }
+        ];
+        ipv6.routes = [
+          {
+            address = "fe80::1";
+            prefixLength = 128;
           }
         ];
       };
@@ -141,18 +134,11 @@
     };
   };
 
-  security = {
+  security.apparmor = {
-    sudo-rs = {
+    enable = true;
-      enable = true;
+    killUnconfinedConfinables = true;
-    };
-    sudo.enable = false;
-
-    apparmor = {
-      enable = true;
-      killUnconfinedConfinables = true;
-    };
-    protectKernelImage = true;
   };
+  security.protectKernelImage = true;
 
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets = {