Daniel Barlow
7e2b0068e6
There is nothing in this commit except for the changes made by nix-shell -p nixfmt-rfc-style --run "nixfmt ." If this has mucked up your open branches then sorry about that. You can probably nixfmt them to match before merging
50 lines
1.1 KiB
Nix
50 lines
1.1 KiB
Nix
{
|
|
liminix,
|
|
lib,
|
|
firewallgen,
|
|
nftables,
|
|
writeFennel,
|
|
anoia,
|
|
lualinux,
|
|
linotify,
|
|
}:
|
|
{
|
|
rules,
|
|
extraRules,
|
|
zones,
|
|
}:
|
|
let
|
|
inherit (liminix.services) longrun;
|
|
inherit (lib.attrsets) mapAttrs' nameValuePair mapAttrsToList;
|
|
inherit (lib.strings) concatStringsSep;
|
|
inherit (lib.lists) flatten;
|
|
mkSet =
|
|
family: name:
|
|
nameValuePair "${name}-set-${family}" {
|
|
kind = "set";
|
|
inherit name family;
|
|
type = "ifname";
|
|
};
|
|
sets = (mapAttrs' (n: _: mkSet "ip" n) zones) // (mapAttrs' (n: _: mkSet "ip6" n) zones);
|
|
allRules = lib.recursiveUpdate extraRules (lib.recursiveUpdate (builtins.trace sets sets) rules);
|
|
script = firewallgen "firewall1.nft" allRules;
|
|
ifwatch = writeFennel "ifwatch" {
|
|
packages = [
|
|
anoia
|
|
lualinux
|
|
linotify
|
|
];
|
|
mainFunction = "run";
|
|
} ./ifwatch.fnl;
|
|
watchArg = z: intfs: map (i: "${z}:${i}/.outputs") intfs;
|
|
in
|
|
longrun {
|
|
name = "firewall";
|
|
run = ''
|
|
${script}
|
|
PATH=${nftables}/bin:$PATH
|
|
${ifwatch} ${concatStringsSep " " (flatten (mapAttrsToList watchArg zones))}
|
|
'';
|
|
finish = "${nftables}/bin/nft flush ruleset";
|
|
}
|