mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat(nftables): update to new nftables firewall branch

Browse source
This commit is contained in:
oddlama 2023-10-15 14:10:06 +02:00
parent 051fdc24cb
commit 1f9a28c3db
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
11 changed files with 48 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

21
hosts/sentinel/net.nix
View file

@ -1,8 +1,4 @@
{
config,
lib,
...
}: {
{config, ...}: {
networking.hostId = config.repo.secrets.local.networking.hostId;
networking.domain = config.repo.secrets.local.personalDomain;
@ -35,19 +31,16 @@
};
};
# TODO mkForce nftables
networking.nftables.firewall = {
zones = lib.mkForce {
zones = {
untrusted.interfaces = ["wan"];
proxy-sentinel.interfaces = ["proxy-sentinel"];
};
rules = lib.mkForce {
# Allow accessing nginx through the proxy
proxy-sentinel-to-local = {
from = ["proxy-sentinel"];
to = ["local"];
allowedTCPPorts = [80 443];
};
# Allow accessing nginx through the proxy
rules.proxy-sentinel-to-local = {
from = ["proxy-sentinel"];
to = ["local"];
allowedTCPPorts = [80 443];
};
};