motiejus/config
1
Fork 0
Code Packages Releases Activity

start/stop firewall commands

Browse Source
This commit is contained in:
Motiejus Jakštys 2023-07-26 15:10:39 +03:00
parent ab11ee31f2
commit 4522af453b
3 changed files with 87 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/base/sshguard/default.nix
View File

@ -15,10 +15,12 @@
services.sshguard = { services.sshguard = {
enable = true; enable = true;
blocktime = 900; blocktime = 900;
whitelist = [ whitelist =
[
"192.168.0.0/16" "192.168.0.0/16"
myData.tailscale_subnet.cidr myData.tailscale_subnet.cidr
] ++ (lib.catAttrs "publicIP" (lib.attrValues myData.hosts)); ]
++ (lib.catAttrs "publicIP" (lib.attrValues myData.hosts));
}; };
}; };
} }

8
modules/base/zfsborg/default.nix
View File

@ -19,7 +19,10 @@ in {
enable = lib.mkEnableOption "backup zfs snapshots with borg"; enable = lib.mkEnableOption "backup zfs snapshots with borg";
passwordPath = lib.mkOption {type = str;}; passwordPath = lib.mkOption {type = str;};
sshKeyPath = lib.mkOption {type = nullOr path; default = null;}; sshKeyPath = lib.mkOption {
type = nullOr path;
default = null;
};
mountpoints = lib.mkOption { mountpoints = lib.mkOption {
default = {}; default = {};
@ -87,7 +90,8 @@ in {
} }
// lib.optionalAttrs (attrs ? patterns) { // lib.optionalAttrs (attrs ? patterns) {
patterns = attrs.patterns; patterns = attrs.patterns;
} // lib.optionalAttrs (config.mj.base.zfsborg.sshKeyPath != null) { }
// lib.optionalAttrs (config.mj.base.zfsborg.sshKeyPath != null) {
environment.BORG_RSH = ''ssh -i "${config.mj.base.zfsborg.sshKeyPath}"''; environment.BORG_RSH = ''ssh -i "${config.mj.base.zfsborg.sshKeyPath}"'';
}; };
}) })

10
modules/services/syncthing/default.nix
View File

@ -13,13 +13,15 @@ in {
dataDir = lib.mkOption {type = path;}; dataDir = lib.mkOption {type = path;};
}; };
config = lib.mkIf config.mj.services.syncthing.enable { config = let
networking.firewall.extraCommands = let
hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts; hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts;
ips = lib.catAttrs "jakstIP" hosts; ips = lib.catAttrs "jakstIP" hosts;
lines = map (ip: "iptables -A INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips; startLines = map (ip: "iptables -A INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
stopLines = map (ip: "iptables -D INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
in in
lib.concatLines lines; lib.mkIf config.mj.services.syncthing.enable {
networking.firewall.extraCommands = lib.concatLines startLines;
networking.firewall.extraStopCommands = lib.concatLines stopLines;
services.syncthing = { services.syncthing = {
enable = config.mj.services.syncthing.enable; enable = config.mj.services.syncthing.enable;