Bun/nixos-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move individual custom firewall rules to their own service files

Browse source
This commit is contained in:
Bun 2025-03-18 03:27:12 -04:00
parent 7635beefb7
commit 505298331e
7 changed files with 61 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

28
hosts/midas/firewall/default.nix
View file

@ -1,28 +1,21 @@
{ lib, config, ... }: { config, lib, ... }:
{ {
networking = { networking.nftables.tables.forwarding = {
firewall.extraInputRules = '' family = "inet";
ip saddr { 10.0.0.0/8, 10.100.0.0/24 } tcp dport 2049 accept comment "Accept NFS"
ip saddr { 10.0.0.0/8, ${config.secrets.ips.luna}, ${config.secrets.ips.corn} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
'';
# Nftables configuration only if server is enabled
nftables.tables.forwarding = {
family = "ip";
content = '' content = ''
chain PREROUTING { chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept; type nat hook prerouting priority dstnat; policy accept;
tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC" tcp dport 2211 dnat ip to ${config.ips.pc}:22 comment "SSH to PC"
udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games" udp dport { 27005, 27015, 7777 } dnat ip to ${config.ips.pc} comment "PC Hosted Games"
tcp dport { 48010, 47989, 47984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP" tcp dport { 48010, 47989, 47984 } dnat ip to ${config.ips.pc} comment "PC Sunshine TCP"
udp dport { 47998, 47999, 48000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP" udp dport { 47998, 47999, 48000 } dnat ip to ${config.ips.pc} comment "PC Sunshine UDP"
tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP" tcp dport { 38010, 37989, 37984 } dnat ip to ${config.ips.vm} comment "VM Sunshine TCP"
udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP" udp dport { 37998, 37999, 38000 } dnat ip to ${config.ips.vm} comment "VM Sunshine UDP"
udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex" udp dport { 7790, 7791, 7792 } dnat ip to ${config.ips.hx} comment "Deus Ex"
} }
chain POSTROUTING { chain POSTROUTING {
@ -31,7 +24,6 @@
} }
''; '';
}; };
};
# Enable IP forwarding for the server configuration # Enable IP forwarding for the server configuration
boot.kernel.sysctl."net.ipv4.ip_forward" = 1; boot.kernel.sysctl."net.ipv4.ip_forward" = 1;

1
modules/system/services/server/default.nix
View file

@ -8,6 +8,7 @@
./mailserver ./mailserver
./minecraft ./minecraft
./mysql ./mysql
./owncast
./socialserver ./socialserver
./transmission ./transmission
./vaultwarden ./vaultwarden

14
modules/system/services/server/fileserver/nfs/default.nix
View file

@ -1,9 +1,10 @@
{ config, ... }: { config, lib, ... }:
{ {
imports = [ ./user ]; imports = [ ./user ];
config = lib.mkIf config.system.fileserver.enable {
services.nfs.server = { services.nfs.server = {
enable = config.system.fileserver.enable; enable = true;
exports = '' exports = ''
/storage/Files *(rw,sync,no_subtree_check) /storage/Files *(rw,sync,no_subtree_check)
/storage/Media *(rw,sync,no_subtree_check) /storage/Media *(rw,sync,no_subtree_check)
@ -11,4 +12,13 @@
/srv/minecraft *(rw,sync,no_subtree_check) /srv/minecraft *(rw,sync,no_subtree_check)
''; '';
}; };
networking.nftables.tables.nfs = {
family = "inet";
content = ''
chain input {
ip saddr 10.0.0.0/8 tcp dport 2049 accept comment "Accept NFS"
}
'';
};
};
} }

8
modules/system/services/server/socialserver/owncast/default.nix → modules/system/services/server/owncast/default.nix
View file

@ -8,6 +8,14 @@
port = 8060; port = 8060;
rtmp-port = 1945; rtmp-port = 1945;
}; };
networking.nftables.tables.owncast = {
family = "inet";
content = ''
chain input {
ip saddr 10.0.0.0/8 tcp dport 1945 accept comment "Accept RTMP"
}
'';
};
environment.persistence."/persist".directories = [ "/var/lib/owncast" ]; environment.persistence."/persist".directories = [ "/var/lib/owncast" ];
}; };
} }

0
modules/system/services/server/socialserver/owncast/nginx/default.nix → modules/system/services/server/owncast/nginx/default.nix
View file

1
modules/system/services/server/socialserver/default.nix
View file

@ -3,7 +3,6 @@
imports = [ imports = [
./mastodon ./mastodon
./matrix ./matrix
./owncast
]; ];
options.system.socialserver.enable = lib.mkEnableOption "Enable social media like services"; options.system.socialserver.enable = lib.mkEnableOption "Enable social media like services";

12
modules/system/services/server/webserver/nginx/rtmp/default.nix
View file

@ -1,8 +1,8 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ {
options.services.nginx.rtmp.enable = lib.mkEnableOption "Enable an RTMP server using Nginx"; options.system.rtmp.enable = lib.mkEnableOption "Enable an RTMP server using Nginx";
config = lib.mkIf config.services.nginx.rtmp.enable { config = lib.mkIf config.system.rtmp.enable {
services.nginx = { services.nginx = {
package = (pkgs.nginx.override { package = (pkgs.nginx.override {
modules = with pkgs.nginxModules; [ rtmp ]; modules = with pkgs.nginxModules; [ rtmp ];
@ -27,6 +27,14 @@
} }
''; '';
}; };
networking.nftables.tables.rtmp = {
family = "inet";
content = ''
chain input {
ip saddr { 10.0.0.0/8, ${config.secrets.ips.luna}, ${config.secrets.ips.corn} } tcp dport 1935 accept comment "Accept RTMP"
}
'';
};
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www/landing-page/streams/hls/" ]; systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www/landing-page/streams/hls/" ];
}; };
} }