friendlyport

hosts/vno1-oh2/configuration.nix

@@ -106,6 +106,12 @@
   services = {
     tailscale.enable = true;
 
+    #grafana = {
+    #  enable = true;
+    #  domain = "vno1-oh2.servers.jakst"; # TODO tailscale service?
+    #  addr = myData.hosts."vno1-oh2.servers.jakst".jakstIP;
+    #};
+
     nsd = {
       enable = true;
       interfaces = ["0.0.0.0" "::"];

modules/services/default.nix

@@ -6,6 +6,7 @@
 }: {
   imports = [
     ./deployerbot
+    ./friendlyport
     ./postfix
     ./syncthing
     ./zfsunlock

modules/services/friendlyport/default.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  myData,
+  ...
+}: {
+  options.mj.services.friendlyport = with lib.types; {
+    ports = lib.mkOption {
+      type = listOf int;
+      default = [];
+    };
+  };
+
+  config = let
+    ports = builtins.concatStringsSep "," (map builtins.toString config.mj.services.friendlyport.ports);
+    hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts;
+    ips = lib.catAttrs "jakstIP" hosts;
+    startLines = map (ip: "iptables -A INPUT -p tcp --match multiport --dports ${ports} --source ${ip} -j ACCEPT") ips;
+    stopLines = map (ip: "iptables -D INPUT -p tcp --match multiport --dports ${ports} --source ${ip} -j ACCEPT") ips;
+  in {
+    networking.firewall.extraCommands = lib.concatLines startLines;
+    networking.firewall.extraStopCommands = lib.concatLines stopLines;
+  };
+}

modules/services/syncthing/default.nix

@@ -13,15 +13,8 @@ in {
     dataDir = lib.mkOption {type = path;};
   };
 
-  config = let
+  config = lib.mkIf config.mj.services.syncthing.enable {
-    hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts;
+    mj.services.friendlyport.ports = [8384];
-    ips = lib.catAttrs "jakstIP" hosts;
-    startLines = map (ip: "iptables -A INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
-    stopLines = map (ip: "iptables -D INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
-  in
-    lib.mkIf config.mj.services.syncthing.enable {
-      networking.firewall.extraCommands = lib.concatLines startLines;
-      networking.firewall.extraStopCommands = lib.concatLines stopLines;
 
     services.syncthing = {
       enable = config.mj.services.syncthing.enable;