surface: enable hotpot

nixos/hosts/arx8/default.nix

@@ -16,7 +16,6 @@
     refind
     efibootmgr
   ];
-  services.dnscrypt-proxy2.enable = true;
   services.create_ap = {
     enable = true;
     settings = {

nixos/hosts/isk/_steam/dst/default.nix

@@ -1,6 +1,5 @@
 {
   config,
-  lib,
   pkgs,
   ...
 }: let

nixos/hosts/surface/default.nix

@@ -17,6 +17,19 @@
     # ipts.enable = true;
   };
 
+  services.create_ap = {
+    enable = true;
+    settings = {
+      INTERNET_IFACE = "wlp1s0";
+      WIFI_IFACE = "wlp1s0";
+      SSID = "ARX8";
+      PASSPHRASE = "qwertyut";
+      # HIDDEN = 1;
+      IEEE80211AX = 1;
+      FREQ_BAND = 5;
+    };
+  };
+
   environment.systemPackages = with pkgs; [
     refind
     efibootmgr

nixos/modules/base/tailscale.nix

@@ -22,7 +22,20 @@ in {
     };
   };
   # TODO: tailscale cannot connect to some derp when firewall is enabled
-  networking.firewall.enable = lib.mkForce false;
+  networking.firewall = {
+    allowedUDPPortRanges = [
+      {
+        from = 0;
+        to = 65535;
+      }
+    ];
+    allowedTCPPortRanges = [
+      {
+        from = 0;
+        to = 65535;
+      }
+    ];
+  };
 
   # systemd.services.tailscale-setup = {
   #   script = ''

nixos/modules/desktop/network-manager.nix

@@ -5,6 +5,7 @@
     enable = true;
     # dns = "dnsmasq";
   };
+  services.dnscrypt-proxy2.enable = true;
   environment.global-persistence.directories = [
     "/etc/NetworkManager/system-connections"
   ];