liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

default.nix (3129B)

      1 ## Firewall
      2 ## ========
      3 ##
      4 ## Provides a service to create an nftables ruleset based on
      5 ## configuration supplied to it.
      6 
      7 {
      8   lib,
      9   pkgs,
     10   config,
     11   ...
     12 }:
     13 let
     14   inherit (lib) mkOption types;
     15   inherit (pkgs) liminix;
     16 
     17   kmodules = pkgs.kmodloader.override {
     18     inherit (config.system.outputs) kernel;
     19     targets = [
     20       "nft_fib_ipv4"
     21       "nft_fib_ipv6"
     22       "nf_log_syslog"
     23 
     24       "ip6_tables"
     25       "ip_tables"
     26       "iptable_nat"
     27       "nf_conntrack"
     28       "nf_defrag_ipv4"
     29       "nf_defrag_ipv6"
     30       "nf_log_syslog"
     31       "nf_nat"
     32       "nf_reject_ipv4"
     33       "nf_reject_ipv6"
     34       "nf_tables"
     35       "nft_chain_nat"
     36       "nft_ct"
     37       "nft_fib"
     38       "nft_fib_ipv4"
     39       "nft_fib_ipv6"
     40       "nft_limit"
     41       "nft_log"
     42       "nft_masq"
     43       "nft_nat"
     44       "nft_reject"
     45       "nft_reject_inet"
     46       "nft_reject_ipv4"
     47       "nft_reject_ipv6"
     48       "x_tables"
     49       "xt_MASQUERADE"
     50       "xt_nat"
     51       "xt_tcpudp"
     52     ];
     53   };
     54 in
     55 {
     56   # we use the secrets subscriber to restart when interfaces change
     57   imports = [ ../secrets ];
     58 
     59   options = {
     60     system.service.firewall = mkOption {
     61       type = liminix.lib.types.serviceDefn;
     62     };
     63   };
     64   config = {
     65     system.service.firewall =
     66       let
     67         svc = config.system.callService ./service.nix {
     68           extraRules = mkOption {
     69             type = types.attrsOf types.attrs;
     70             description = "firewall ruleset";
     71             default = { };
     72           };
     73           zones = mkOption {
     74             type = types.attrsOf (types.listOf liminix.lib.types.service);
     75             default = { };
     76             example = lib.literalExpression ''
     77               {
     78                 lan = with config.hardware.networkInterfaces; [ int ];
     79                 wan = [ config.services.ppp0 ];
     80               }
     81             '';
     82           };
     83           rules = mkOption {
     84             type = types.attrsOf types.attrs; # we could usefully tighten this a bit :-)
     85             default = import ./default-rules.nix;
     86             description = "firewall ruleset";
     87           };
     88         };
     89       in
     90       svc
     91       // {
     92         build =
     93           args:
     94           let
     95             args' = args // {
     96               dependencies = (args.dependencies or [ ]) ++ [ kmodules ];
     97             };
     98           in
     99           svc.build args';
    100       };
    101     programs.busybox.applets = [
    102       "insmod"
    103       "rmmod"
    104     ];
    105     kernel.config = {
    106       NETFILTER = "y";
    107       NETFILTER_ADVANCED = "y";
    108       NETFILTER_NETLINK = "m";
    109       NF_CONNTRACK = "m";
    110 
    111       NETLINK_DIAG = "y";
    112 
    113       IP6_NF_IPTABLES = "m";
    114       IP_NF_IPTABLES = "m";
    115       IP_NF_NAT = "m";
    116       IP_NF_TARGET_MASQUERADE = "m";
    117 
    118       NFT_CT = "m";
    119       NFT_FIB_IPV4 = "m";
    120       NFT_FIB_IPV6 = "m";
    121       NFT_LIMIT = "m";
    122       NFT_LOG = "m";
    123       NFT_MASQ = "m";
    124       NFT_NAT = "m";
    125       NFT_REJECT = "m";
    126       NFT_REJECT_INET = "m";
    127 
    128       NF_CT_PROTO_DCCP = "y";
    129       NF_CT_PROTO_SCTP = "y";
    130       NF_CT_PROTO_UDPLITE = "y";
    131       NF_LOG_SYSLOG = "m";
    132       NF_NAT = "m";
    133       NF_NAT_MASQUERADE = "y";
    134       NF_TABLES = "m";
    135       NF_TABLES_INET = "y";
    136       NF_TABLES_IPV4 = "y";
    137       NF_TABLES_IPV6 = "y";
    138     };
    139   };
    140 }