liminix/modules/firewall/service.nix

{
  liminix
, lib
, firewallgen
, nftables
}:
{ rules, extraRules }:
let
  inherit (liminix.services) oneshot;
  script = firewallgen "firewall.nft" (lib.recursiveUpdate rules extraRules);
in oneshot {
  name = "firewall";
  up = script;
  down = "${nftables}/bin/nft flush ruleset";
}
turn nftables firewall into a service-providing module 2023-07-16 15:55:50 +00:00			`{`
			`liminix`
			`, lib`
			`, firewallgen`
			`, nftables`
			`}:`
firewall module: provide default rules and merge extraRules a firewall with no configuration will get a relatively sane ruleset. a firewall with `extraRules` will get them deep merged into the default rules. Specifying `rules` will override the defaults 2024-03-21 12:00:34 +00:00			`{ rules, extraRules }:`
turn nftables firewall into a service-providing module 2023-07-16 15:55:50 +00:00			`let`
			`inherit (liminix.services) oneshot;`
firewall module: provide default rules and merge extraRules a firewall with no configuration will get a relatively sane ruleset. a firewall with `extraRules` will get them deep merged into the default rules. Specifying `rules` will override the defaults 2024-03-21 12:00:34 +00:00			`script = firewallgen "firewall.nft" (lib.recursiveUpdate rules extraRules);`
turn nftables firewall into a service-providing module 2023-07-16 15:55:50 +00:00			`in oneshot {`
			`name = "firewall";`
			`up = script;`
			`down = "${nftables}/bin/nft flush ruleset";`
			`}`