cbrst/nix
ModulesNixOS

Network

DNS, firewall, and Tailscale.

modules/nixos/network.nix is imported by the desktop profile.

DNS

NetworkManager does not take DNS servers from the router. The system uses Quad9 (IPv4 and IPv6), with Cloudflare as the fallback.

Firewall

The firewall is enabled and uses nftables. The Tailscale interface is trusted, and Tailscale's UDP port is open so direct connections work.

Tailscale

The Tailscale daemon is enabled and told to use nftables mode for its own firewall rules. Each host chooses its operator; Asgard sets cbrst, so the CLI and the tray application work without sudo.

Boot

The "wait online" units are disabled in both the system and the initrd, so a slow or missing network never delays boot.

Last updated on

Base system

Nix settings, garbage collection, and system-wide essentials for every NixOS host.

Desktop

Niri, Noctalia and its greeter, PipeWire, fonts, GTK, Nautilus, and desktop applications at the system level.

On this page

DNSFirewallTailscaleBoot