Fix some firewall rules

modules/system/services/server/fileserver/nfs/default.nix

@@ -15,6 +15,7 @@
       family = "inet";
       content = ''
         chain input {
+	  type filter hook input priority filter; policy drop;
           ip saddr 10.0.0.0/8 tcp dport 2049 accept comment "Accept NFS"
         }
       '';

modules/system/services/server/mailserver/go-autoconfig/default.nix

@@ -1,20 +1,25 @@
-{ config, ... }:
+{ config, lib, ... }:
 {
   imports = [ ./nginx ];
 
-  services.go-autoconfig = {
+  config = lib.mkIf config.services.mailserver.enable {
-    enable = config.services.mailserver.enable;
+    services = {
-    settings = {
+      go-autoconfig = {
-      service_addr = ":1323";
+        enable = true;
-      domain = "autoconfig.nixfox.ca";
+        settings = {
-      imap = {
+          service_addr = ":1323";
-        server = "mx.nixfox.ca";
+          domain = "autoconfig.nixfox.ca";
-        port = 143;
+          imap = {
-      };
+            server = "mx.nixfox.ca";
-      smtp = {
+            port = 143;
-        server = "mx.nixfox.ca";
+          };
-        port = 587;
+          smtp = {
+            server = "mx.nixfox.ca";
+            port = 587;
+          };
+        };
       };
+      cloudflare-dyndns.domains = [ config.services.go-autoconfig.settings.domain ];
     };
   };
 }

modules/system/services/server/mailserver/simplenix/default.nix

@@ -28,6 +28,7 @@
             "jimbo@bloxelcom.net"
 
             "bun@nixfox.ca"
+            #"vice@nixfox.ca"
             "bun@bloxelcom.net"
             "yara@nixfox.ca"
 
@@ -61,8 +62,10 @@
       };
     };
 
-    # Rspamd port from earlier to avoid overlap
+    services = {
-    services.redis.servers.rspamd.port = config.mailserver.redis.port;
+      redis.servers.rspamd.port = config.mailserver.redis.port;
+      cloudflare-dyndns.domains = [ config.mailserver.fqdn ];
+    };
 
     environment.persistence."/persist".directories = [
       "/var/vmail"

modules/system/services/server/nginx/rtmp/default.nix

@@ -29,6 +29,7 @@
       family = "inet";
       content = ''
         chain input {
+	  type filter hook input priority 0; policy drop;
           ip saddr { 10.0.0.0/8, ${config.secrets.ips.luna}, ${config.secrets.ips.corn} } tcp dport 1935 accept comment "Accept RTMP"
         }
       '';

modules/system/services/server/owncast/default.nix

@@ -11,6 +11,7 @@
       family = "inet";
       content = ''
         chain input {
+	  type filter hook input priority filter; policy drop;
           ip saddr 10.0.0.0/8 tcp dport 1945 accept comment "Accept RTMP"
         }
       '';

modules/system/services/server/socialserver/matrix/coturn/default.nix

@@ -27,11 +27,9 @@
         turn_user_lifetime = "1h";
       };
 
-      # Sync the IP to Cloudflare
       cloudflare-dyndns.domains = [ config.services.coturn.realm ];
     };
 
-    # Open coturn ports
     networking.firewall = {
       allowedUDPPorts = [
         3478