friendlyport

This commit is contained in:
Motiejus Jakštys 2023-08-05 18:00:43 +03:00
parent 43d6d25dd0
commit f4e04faef3
4 changed files with 110 additions and 86 deletions

View File

@ -106,6 +106,12 @@
services = { services = {
tailscale.enable = true; tailscale.enable = true;
#grafana = {
# enable = true;
# domain = "vno1-oh2.servers.jakst"; # TODO tailscale service?
# addr = myData.hosts."vno1-oh2.servers.jakst".jakstIP;
#};
nsd = { nsd = {
enable = true; enable = true;
interfaces = ["0.0.0.0" "::"]; interfaces = ["0.0.0.0" "::"];

View File

@ -6,6 +6,7 @@
}: { }: {
imports = [ imports = [
./deployerbot ./deployerbot
./friendlyport
./postfix ./postfix
./syncthing ./syncthing
./zfsunlock ./zfsunlock

View File

@ -0,0 +1,24 @@
{
config,
lib,
myData,
...
}: {
options.mj.services.friendlyport = with lib.types; {
ports = lib.mkOption {
type = listOf int;
default = [];
};
};
config = let
ports = builtins.concatStringsSep "," (map builtins.toString config.mj.services.friendlyport.ports);
hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts;
ips = lib.catAttrs "jakstIP" hosts;
startLines = map (ip: "iptables -A INPUT -p tcp --match multiport --dports ${ports} --source ${ip} -j ACCEPT") ips;
stopLines = map (ip: "iptables -D INPUT -p tcp --match multiport --dports ${ports} --source ${ip} -j ACCEPT") ips;
in {
networking.firewall.extraCommands = lib.concatLines startLines;
networking.firewall.extraStopCommands = lib.concatLines stopLines;
};
}

View File

@ -13,15 +13,8 @@ in {
dataDir = lib.mkOption {type = path;}; dataDir = lib.mkOption {type = path;};
}; };
config = let config = lib.mkIf config.mj.services.syncthing.enable {
hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts; mj.services.friendlyport.ports = [8384];
ips = lib.catAttrs "jakstIP" hosts;
startLines = map (ip: "iptables -A INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
stopLines = map (ip: "iptables -D INPUT -p tcp --dport 8384 -s ${ip} -j ACCEPT") ips;
in
lib.mkIf config.mj.services.syncthing.enable {
networking.firewall.extraCommands = lib.concatLines startLines;
networking.firewall.extraStopCommands = lib.concatLines stopLines;
services.syncthing = { services.syncthing = {
enable = config.mj.services.syncthing.enable; enable = config.mj.services.syncthing.enable;