liminix/modules/firewall/default.nix

## Firewall
## ========
##
## Provides a service to create an nftables ruleset based on
## configuration supplied to it.

{
  lib,
  pkgs,
  config,
  ...
}:
let
  inherit (lib) mkOption types;
  inherit (pkgs) liminix;

  kmodules = pkgs.kmodloader.override {
    inherit (config.system.outputs) kernel;
    targets = [
      "nft_fib_ipv4"
      "nft_fib_ipv6"
      "nf_log_syslog"

      "ip6_tables"
      "ip_tables"
      "iptable_nat"
      "nf_conntrack"
      "nf_defrag_ipv4"
      "nf_defrag_ipv6"
      "nf_log_syslog"
      "nf_nat"
      "nf_reject_ipv4"
      "nf_reject_ipv6"
      "nf_tables"
      "nft_chain_nat"
      "nft_ct"
      "nft_fib"
      "nft_fib_ipv4"
      "nft_fib_ipv6"
      "nft_log"
      "nft_masq"
      "nft_nat"
      "nft_reject"
      "nft_reject_inet"
      "nft_reject_ipv4"
      "nft_reject_ipv6"
      "x_tables"
      "xt_MASQUERADE"
      "xt_nat"
      "xt_tcpudp"
    ];
  };
in
{
  options = {
    system.service.firewall = mkOption {
      type = liminix.lib.types.serviceDefn;
    };
  };
  config = {
    system.service.firewall =
      let
        svc = config.system.callService ./service.nix {
          extraRules = mkOption {
            type = types.attrsOf types.attrs;
            description = "firewall ruleset";
            default = { };
          };
          zones = mkOption {
            type = types.attrsOf (types.listOf liminix.lib.types.service);
            default = { };
            example = lib.literalExpression ''
              {
                lan = with config.hardware.networkInterfaces; [ int ];
                wan = [ config.services.ppp0 ];
              }
            '';
          };
          rules = mkOption {
            type = types.attrsOf types.attrs; # we could usefully tighten this a bit :-)
            default = import ./default-rules.nix;
            description = "firewall ruleset";
          };
        };
      in
      svc
      // {
        build =
          args:
          let
            args' = args // {
              dependencies = (args.dependencies or [ ]) ++ [ kmodules ];
            };
          in
          svc.build args';
      };
    programs.busybox.applets = [
      "insmod"
      "rmmod"
    ];
    kernel.config = {
      NETFILTER = "y";
      NETFILTER_ADVANCED = "y";
      NETFILTER_NETLINK = "m";
      NF_CONNTRACK = "m";

      NETLINK_DIAG = "y";

      IP6_NF_IPTABLES = "m";
      IP_NF_IPTABLES = "m";
      IP_NF_NAT = "m";
      IP_NF_TARGET_MASQUERADE = "m";

      NFT_CT = "m";
      NFT_FIB_IPV4 = "m";
      NFT_FIB_IPV6 = "m";
      NFT_LOG = "m";
      NFT_MASQ = "m";
      NFT_NAT = "m";
      NFT_REJECT = "m";
      NFT_REJECT_INET = "m";

      NF_CT_PROTO_DCCP = "y";
      NF_CT_PROTO_SCTP = "y";
      NF_CT_PROTO_UDPLITE = "y";
      NF_LOG_SYSLOG = "m";
      NF_NAT = "m";
      NF_NAT_MASQUERADE = "y";
      NF_TABLES = "m";
      NF_TABLES_INET = "y";
      NF_TABLES_IPV4 = "y";
      NF_TABLES_IPV6 = "y";
    };
  };
}