feat(ward): open kanidm port only for sentinel

hosts/sentinel/default.nix

@@ -14,6 +14,4 @@
     ./net.nix
     ./nginx.nix
   ];
-
-  boot.loader.grub.devices = ["/dev/disk/by-id/${config.repo.secrets.local.disk.main}"];
 }

hosts/sentinel/fs.nix

@@ -39,6 +39,7 @@
     };
   };
 
+  boot.loader.grub.devices = ["/dev/disk/by-id/${config.repo.secrets.local.disk.main}"];
   boot.initrd.luks.devices.enc-rpool.allowDiscards = true;
   fileSystems."/persist".neededForBoot = true;
 

hosts/sentinel/nginx.nix

@@ -49,6 +49,7 @@ in {
       locations."/".proxyPass = "https://kanidm";
       # Allow using self-signed certs to satisfy kanidm's requirement
       # for TLS connections. (This is over wireguard anyway)
+      # TODO can we get rid of this?
       extraConfig = ''
         proxy_ssl_verify off;
       '';

hosts/ward/default.nix

@@ -76,12 +76,26 @@ in {
 
     networking.nftables.firewall = {
       zones = lib.mkForce {
-        local-vms.interfaces = ["local-vms"];
+        #local-vms.interfaces = ["local-vms"];
+        proxy-sentinel.interfaces = ["proxy-sentinel"];
+        sentinel = {
+          parent = "proxy-sentinel";
+          ipv4Addresses = [nodes.sentinel.config.extra.wireguard.proxy-sentinel.ipv4];
+          ipv6Addresses = [nodes.sentinel.config.extra.wireguard.proxy-sentinel.ipv6];
+        };
       };
 
+      #rules = lib.mkForce {
+      #  local-vms-to-local = {
+      #    from = ["local-vms"];
+      #    to = ["local"];
+      #    allowedTCPPorts = [8300];
+      #  };
+      #};
+
       rules = lib.mkForce {
-        local-vms-to-local = {
-          from = ["local-vms"];
+        sentinel-to-local = {
+          from = ["sentinel"];
           to = ["local"];
           allowedTCPPorts = [8300];
         };

hosts/ward/net.nix

@@ -139,6 +139,7 @@ in {
         renew-timer = 1000;
         rebind-timer = 2000;
         interfaces-config = {
+          # TODO why does this bind other macvtaps?
           interfaces = ["lan-self"];
           service-sockets-max-retries = -1;
         };