start/stop firewall commands
This commit is contained in:
parent
ab11ee31f2
commit
4522af453b
|
@ -15,10 +15,12 @@
|
|||
services.sshguard = {
|
||||
enable = true;
|
||||
blocktime = 900;
|
||||
whitelist = [
|
||||
whitelist =
|
||||
[
|
||||
"192.168.0.0/16"
|
||||
myData.tailscale_subnet.cidr
|
||||
] ++ (lib.catAttrs "publicIP" (lib.attrValues myData.hosts));
|
||||
]
|
||||
++ (lib.catAttrs "publicIP" (lib.attrValues myData.hosts));
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -19,7 +19,10 @@ in {
|
|||
enable = lib.mkEnableOption "backup zfs snapshots with borg";
|
||||
|
||||
passwordPath = lib.mkOption {type = str;};
|
||||
sshKeyPath = lib.mkOption {type = nullOr path; default = null;};
|
||||
sshKeyPath = lib.mkOption {
|
||||
type = nullOr path;
|
||||
default = null;
|
||||
};
|
||||
|
||||
mountpoints = lib.mkOption {
|
||||
default = {};
|
||||
|
@ -87,7 +90,8 @@ in {
|
|||
}
|
||||
// lib.optionalAttrs (attrs ? patterns) {
|
||||
patterns = attrs.patterns;
|
||||
} // lib.optionalAttrs (config.mj.base.zfsborg.sshKeyPath != null) {
|
||||
}
|
||||
// lib.optionalAttrs (config.mj.base.zfsborg.sshKeyPath != null) {
|
||||
environment.BORG_RSH = ''ssh -i "${config.mj.base.zfsborg.sshKeyPath}"'';
|
||||
};
|
||||
})
|
||||
|
|
|
@ -13,13 +13,15 @@ in {
|
|||
dataDir = lib.mkOption {type = path;};
|
||||
};
|
||||
|
||||
config = lib.mkIf config.mj.services.syncthing.enable {
|
||||
networking.firewall.extraCommands = let
|
||||
config = let
|
||||
hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts;
|
||||
ips = lib.catAttrs "jakstIP" hosts;
|
||||
lines = map (ip: "iptables -A INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
|
||||
startLines = map (ip: "iptables -A INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
|
||||
stopLines = map (ip: "iptables -D INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
|
||||
in
|
||||
lib.concatLines lines;
|
||||
lib.mkIf config.mj.services.syncthing.enable {
|
||||
networking.firewall.extraCommands = lib.concatLines startLines;
|
||||
networking.firewall.extraStopCommands = lib.concatLines stopLines;
|
||||
|
||||
services.syncthing = {
|
||||
enable = config.mj.services.syncthing.enable;
|
||||
|
|
Loading…
Reference in New Issue