liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

default.nix (2506B)

      1 ## Firewall
      2 ## ========
      3 ##
      4 ## Provides a service to create an nftables ruleset based on
      5 ## configuration supplied to it.
      6 
      7 { lib, pkgs, config, ...}:
      8 let
      9   inherit (lib) mkOption types;
     10   inherit (pkgs) liminix;
     11   inherit (pkgs.liminix.services) oneshot;
     12 
     13   kconf = isModule :
     14     # setting isModule false is utterly untested and mostly
     15     # unimplemented: I say this to preempt any "how on earth is this
     16     # even supposed to work?" questions
     17     let yes = if isModule then "m" else "y";
     18     in {
     19       NFT_FIB_IPV4 = yes;
     20       NFT_FIB_IPV6 = yes;
     21       NF_TABLES = yes;
     22       NF_CT_PROTO_DCCP = "y";
     23       NF_CT_PROTO_SCTP = "y";
     24       NF_CT_PROTO_UDPLITE = "y";
     25       # NF_CONNTRACK_FTP = yes;
     26       NFT_CT = yes;
     27     };
     28   kmodules = pkgs.kernel-modules.override {
     29     kernelSrc = config.system.outputs.kernel.src;
     30     modulesupport = config.system.outputs.kernel.modulesupport;
     31     targets = [
     32       "nft_fib_ipv4"
     33       "nft_fib_ipv6"
     34     ];
     35     kconfig = kconf true;
     36   };
     37   loadModules = oneshot {
     38     name = "firewall-modules";
     39     up = "sh ${kmodules}/load.sh";
     40     down = "sh ${kmodules}/unload.sh";
     41   };
     42 in
     43 {
     44   options = {
     45     system.service.firewall = mkOption {
     46       type = liminix.lib.types.serviceDefn;
     47     };
     48   };
     49   config = {
     50     system.service.firewall =
     51       let svc = liminix.callService ./service.nix  {
     52             ruleset = mkOption {
     53               type = types.attrsOf types.attrs;   # we could usefully tighten this a bit :-)
     54               description = "firewall ruleset";
     55             };
     56           };
     57       in svc // {
     58         build = args : (svc.build args) // {
     59           dependencies = [ loadModules ] ++ (svc.dependencies or []);
     60         };
     61       };
     62 
     63     # For historical reasons the kernel config is split between
     64     # monolithic options and modules. TODO: go through this list
     65     # and see what can be moved into the "kconf" definiton above
     66     kernel.config = {
     67       NETFILTER_XT_MATCH_CONNTRACK = "y";
     68 
     69       IP6_NF_IPTABLES= "y";
     70       IP_NF_IPTABLES= "y";
     71 
     72       IP_NF_NAT = "y";
     73       IP_NF_TARGET_MASQUERADE = "y";
     74       NETFILTER = "y";
     75       NETFILTER_ADVANCED = "y";
     76       NETFILTER_XTABLES = "y";
     77 
     78       NFT_COMPAT = "y";
     79       NFT_CT = "y";
     80       NFT_LOG = "y";
     81       NFT_MASQ = "y";
     82       NFT_NAT = "y";
     83       NFT_REJECT = "y";
     84       NFT_REJECT_INET = "y";
     85 
     86       NF_CONNTRACK = "y";
     87       NF_NAT = "y";
     88       NF_NAT_MASQUERADE  = "y";
     89       NF_TABLES= "y";
     90       NF_TABLES_INET = "y";
     91       NF_TABLES_IPV4 = "y";
     92       NF_TABLES_IPV6 = "y";
     93     };
     94   };
     95 }