liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

default.nix (2316B)

      1 ## Firewall
      2 ## ========
      3 ##
      4 ## Provides a service to create an nftables ruleset based on
      5 ## configuration supplied to it.
      6 
      7 { lib, pkgs, config, ...}:
      8 let
      9   inherit (lib) mkOption types;
     10   inherit (pkgs) liminix;
     11   inherit (pkgs.liminix.services) oneshot;
     12 
     13   kmodules = pkgs.kmodloader.override {
     14     inherit (config.system.outputs) kernel;
     15     targets = [
     16       "nft_fib_ipv4"
     17       "nft_fib_ipv6"
     18       "nf_log_syslog"
     19 
     20       "ip6_tables"
     21       "ip_tables"
     22       "iptable_nat"
     23       "nf_conntrack"
     24       "nf_defrag_ipv4"
     25       "nf_defrag_ipv6"
     26       "nf_log_syslog"
     27       "nf_nat"
     28       "nf_reject_ipv4"
     29       "nf_reject_ipv6"
     30       "nf_tables"
     31       "nft_chain_nat"
     32       "nft_ct"
     33       "nft_fib"
     34       "nft_fib_ipv4"
     35       "nft_fib_ipv6"
     36       "nft_log"
     37       "nft_masq"
     38       "nft_nat"
     39       "nft_reject"
     40       "nft_reject_inet"
     41       "nft_reject_ipv4"
     42       "nft_reject_ipv6"
     43       "x_tables"
     44       "xt_MASQUERADE"
     45       "xt_nat"
     46       "xt_tcpudp"
     47     ];
     48   };
     49 in
     50 {
     51   options = {
     52     system.service.firewall = mkOption {
     53       type = liminix.lib.types.serviceDefn;
     54     };
     55   };
     56   config = {
     57     system.service.firewall =
     58       let svc = liminix.callService ./service.nix  {
     59             ruleset = mkOption {
     60               type = types.attrsOf types.attrs;   # we could usefully tighten this a bit :-)
     61               description = "firewall ruleset";
     62             };
     63           };
     64       in svc // {
     65         build = args :
     66           let args' = args // {
     67                 dependencies = (args.dependencies or []) ++ [kmodules];
     68               };
     69           in svc.build args' ;
     70       };
     71 
     72     kernel.config = {
     73       NETFILTER = "y";
     74       NETFILTER_ADVANCED = "y";
     75       NETFILTER_NETLINK = "m";
     76       NF_CONNTRACK = "m";
     77 
     78       IP6_NF_IPTABLES=  "m";
     79       IP_NF_IPTABLES = "m";
     80       IP_NF_NAT = "m";
     81       IP_NF_TARGET_MASQUERADE = "m";
     82 
     83       NFT_CT = "m";
     84       NFT_FIB_IPV4 = "m";
     85       NFT_FIB_IPV6 = "m";
     86       NFT_LOG = "m";
     87       NFT_MASQ = "m";
     88       NFT_NAT = "m";
     89       NFT_REJECT = "m";
     90       NFT_REJECT_INET = "m";
     91 
     92       NF_CT_PROTO_DCCP = "y";
     93       NF_CT_PROTO_SCTP = "y";
     94       NF_CT_PROTO_UDPLITE = "y";
     95       NF_LOG_SYSLOG = "m";
     96       NF_NAT = "m";
     97       NF_NAT_MASQUERADE = "y";
     98       NF_TABLES = "m";
     99       NF_TABLES_INET = "y";
    100       NF_TABLES_IPV4 = "y";
    101       NF_TABLES_IPV6 = "y";
    102     };
    103   };
    104 }