liminix

commit f73a9d82dc93766080611c9e5f11828bfb3c8bb2
parent 1117f98afc805502fb4cbb93f3af0fcda7c9281b
Author: Daniel Barlow <dan@telent.net>
Date:   Sun, 16 Jul 2023 17:04:19 +0100

add comments

Diffstat:
M
modules/firewall/default.nix
 | 
7
+++++--

1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/modules/firewall/default.nix b/modules/firewall/default.nix
@@ -44,11 +44,14 @@ in
       let svc = (pkgs.callPackage ./service.nix {}) params;
       in svc // { dependencies = svc.dependencies ++ [loadModules]; };
 
+    # For historical reasons the kernel config is split between
+    # monolithic options and modules. TODO: go through this list
+    # and see what can be moved into the "kconf" definiton above
     kernel.config = {
       NETFILTER_XT_MATCH_CONNTRACK = "y";
 
-      IP6_NF_IPTABLES= "y";     # do we still need these
-      IP_NF_IPTABLES= "y";      # if using nftables directly
+      IP6_NF_IPTABLES= "y";
+      IP_NF_IPTABLES= "y";
 
       IP_NF_NAT = "y";
       IP_NF_TARGET_MASQUERADE = "y";