lass.pds.lassul.us / superconfig
This repository has no description
0
Fork 1

Configure Feed

Select the types of activity you want to include in your feed.

move some config from krebs.iptables to networking.firewall

author
lassulus date (Nov 22, 2025, 6:34 PM +0700) commit 3265814b parent 3f42a1f3
+43 -220
+7 -38
2configs/default.nix
··· 315 315 predicate = "-i lo"; 316 316 target = "ACCEPT"; 317 317 } 318 - { 319 - predicate = "-p tcp --dport 22"; 320 - target = "ACCEPT"; 321 - } 322 - ]) 323 - (lib.mkOrder 1000 [ 324 - { 325 - predicate = "-p udp --dport 60000:61000"; 326 - target = "ACCEPT"; 327 - } # mosh 328 - { 329 - predicate = "-i retiolum -p udp -m udp --dport 53"; 330 - target = "ACCEPT"; 331 - } 332 - { 333 - predicate = "-i retiolum -p tcp --dport 19999"; 334 - target = "ACCEPT"; 335 - } 336 - ]) 337 - (lib.mkAfter [ 338 - { 339 - predicate = "-p tcp -i retiolum"; 340 - target = "REJECT --reject-with tcp-reset"; 341 - } 342 - { 343 - predicate = "-p udp -i retiolum"; 344 - target = "REJECT --reject-with icmp-port-unreachable"; 345 - v6 = false; 346 - } 347 - { 348 - predicate = "-i retiolum"; 349 - target = "REJECT --reject-with icmp-proto-unreachable"; 350 - v6 = false; 351 - } 352 318 ]) 353 319 ]; 354 320 }; 355 321 }; 356 322 323 + networking.firewall.allowedTCPPorts = [ 22 ]; # ssh 324 + networking.firewall.allowedUDPPortRanges = [ 325 + { 326 + from = 60000; 327 + to = 61000; 328 + } 329 + ]; # mosh 357 330 networking.extraHosts = '' 358 331 10.42.0.1 styx.gg23 359 332 ''; ··· 364 337 365 338 # disable doc usually 366 339 documentation.nixos.enable = lib.mkDefault false; 367 - 368 - # use latest nix to hunt all the bugs 369 - nix.package = pkgs.nixVersions.latest; 370 - 371 340 }
-14
2configs/games.nix
··· 40 40 hardware.graphics.enable32Bit = true; 41 41 services.pulseaudio.support32Bit = true; 42 42 43 - security.sudo.extraConfig = '' 44 - ${mainUser.name} ALL=(games) NOPASSWD: ALL 45 - ''; 46 - 47 - krebs.iptables.tables.filter.INPUT.rules = [ 48 - { 49 - predicate = "-p tcp --dport 10666"; 50 - target = "ACCEPT"; 51 - } 52 - { 53 - predicate = "-p udp --dport 10666"; 54 - target = "ACCEPT"; 55 - } 56 - ]; 57 43 }
+1 -6
2configs/iodined.nix
··· 13 13 extraConfig = "-c -l ${config.krebs.build.host.nets.internet.ip4.addr}"; 14 14 }; 15 15 16 - krebs.iptables.tables.filter.INPUT.rules = [ 17 - { 18 - predicate = "-p udp --dport 53"; 19 - target = "ACCEPT"; 20 - } 21 - ]; 16 + networking.firewall.allowedUDPPorts = [ 53 ]; 22 17 23 18 }
-11
2configs/realwallpaper.nix
··· 42 42 root /var/realwallpaper/archive; 43 43 ''; 44 44 }; 45 - 46 - krebs.iptables = { 47 - tables = { 48 - filter.INPUT.rules = [ 49 - { 50 - predicate = "-i retiolum -p tcp --dport 80"; 51 - target = "ACCEPT"; 52 - } 53 - ]; 54 - }; 55 - }; 56 45 }
-10
2configs/websites/domsen.nix
··· 181 181 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem"; 182 182 sslServerKey = "/var/lib/acme/lassul.us/key.pem"; 183 183 }; 184 - krebs.iptables.tables.filter.INPUT.rules = [ 185 - { 186 - predicate = "-p tcp --dport pop3s"; 187 - target = "ACCEPT"; 188 - } 189 - { 190 - predicate = "-p tcp --dport imaps"; 191 - target = "ACCEPT"; 192 - } 193 - ]; 194 184 195 185 environment.systemPackages = [ 196 186 (pkgs.writers.writeDashBin "debug_exim" ''
-18
machines/mors/config.nix
··· 30 30 ../../2configs/autotether.nix 31 31 ../../2configs/autoupdate.nix 32 32 { 33 - krebs.iptables.tables.filter.INPUT.rules = [ 34 - #risk of rain 35 - { 36 - predicate = "-p tcp --dport 11100"; 37 - target = "ACCEPT"; 38 - } 39 - #quake3 40 - { 41 - predicate = "-p tcp --dport 27950:27965"; 42 - target = "ACCEPT"; 43 - } 44 - { 45 - predicate = "-p udp --dport 27950:27965"; 46 - target = "ACCEPT"; 47 - } 48 - ]; 49 - } 50 - { 51 33 services.nginx = { 52 34 enable = true; 53 35 virtualHosts.default = {
+2 -26
2configs/services/coms/murmur.nix
··· 13 13 # rememberchannelduration=10000 14 14 ''; 15 15 }; 16 - krebs.iptables.tables.filter.INPUT.rules = [ 17 - { 18 - predicate = "-p tcp --dport 64738"; 19 - target = "ACCEPT"; 20 - } 21 - { 22 - predicate = "-p udp --dport 64738"; 23 - target = "ACCEPT"; 24 - } 25 - ]; 26 - 27 - # services.botamusique = { 28 - # enable = true; 29 - # settings = { 30 - # server.host = "lassul.us"; 31 - # bot.auto_check_updates = false; 32 - # bot.max_track_duration = 360; 33 - # webinterface.enabled = true; 34 - # }; 35 - # }; 16 + networking.firewall.allowedTCPPorts = [ 64738 ]; 17 + networking.firewall.allowedUDPPorts = [ 64738 ]; 36 18 37 19 services.nginx.virtualHosts."lassul.us" = { 38 20 enableACME = true; ··· 44 26 "nginx" 45 27 "murmur" 46 28 ]; 47 - 48 - # services.nginx.virtualHosts."bota.r" = { 49 - # locations."/" = { 50 - # proxyPass = "http://localhost:8181"; 51 - # }; 52 - # }; 53 29 }
-8
2configs/services/flix/container-host.nix
··· 16 16 hostPath = "/var/download"; 17 17 isReadOnly = false; 18 18 }; 19 - # krebs.iptables.tables.filter.FORWARD.rules = [ 20 - # { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip4.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v6 = false; } 21 - # { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip6.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v4 = false; } 22 - # ]; 23 - # krebs.iptables.tables.nat.PREROUTING.rules = [ 24 - # { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip4.addr}:8000"; v6 = false; } 25 - # { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip6.addr}:8000"; v4 = false; } 26 - # ]; 27 19 networking.firewall.allowedTCPPorts = [ 28 20 8096 29 21 8920
+25 -70
2configs/services/flix/default.nix
··· 239 239 }; 240 240 }; 241 241 242 + networking.firewall.allowedTCPPorts = [ 243 + 80 # nginx 244 + 443 # nginx 245 + 9091 # transmission web 246 + 8096 # jellyfin 247 + 8920 # jellyfin 248 + 51413 # transmission traffic 249 + 445 # smbd 250 + 111 # smbd 251 + 2049 # smbd 252 + 4000 # smbd 253 + 4001 # smbd 254 + 4002 # smbd 255 + ]; 256 + networking.firewall.allowedUDPPorts = [ 257 + 51413 # transmission traffic 258 + 1900 # jellyfin 259 + 7359 # jellyfin 260 + 111 # smbd 261 + 2049 # smbd 262 + 4000 # smbd 263 + 4001 # smbd 264 + 4002 # smbd 265 + ]; 242 266 krebs.iptables = { 243 267 enable = true; 244 - tables.filter.INPUT.rules = [ 245 - { 246 - predicate = "-p tcp --dport 80"; 247 - target = "ACCEPT"; 248 - } # nginx web dir 249 - { 250 - predicate = "-p tcp --dport 443"; 251 - target = "ACCEPT"; 252 - } # nginx web dir 253 - { 254 - predicate = "-p tcp --dport 9091"; 255 - target = "ACCEPT"; 256 - } # transmission-web 257 - { 258 - predicate = "-p tcp --dport 51413"; 259 - target = "ACCEPT"; 260 - } # transmission-traffic 261 - { 262 - predicate = "-p udp --dport 51413"; 263 - target = "ACCEPT"; 264 - } # transmission-traffic 265 - { 266 - predicate = "-p tcp --dport 8096"; 267 - target = "ACCEPT"; 268 - } # jellyfin 269 - { 270 - predicate = "-p tcp --dport 8920"; 271 - target = "ACCEPT"; 272 - } # jellyfin 273 - { 274 - predicate = "-p udp --dport 1900"; 275 - target = "ACCEPT"; 276 - } # jellyfin 277 - { 278 - predicate = "-p udp --dport 7359"; 279 - target = "ACCEPT"; 280 - } # jellyfin 281 - 282 - # smbd 283 - { 284 - predicate = "-p tcp --dport 445"; 285 - target = "ACCEPT"; 286 - } 287 - { 288 - predicate = "-p tcp --dport 111"; 289 - target = "ACCEPT"; 290 - } 291 - { 292 - predicate = "-p udp --dport 111"; 293 - target = "ACCEPT"; 294 - } 295 - { 296 - predicate = "-p tcp --dport 2049"; 297 - target = "ACCEPT"; 298 - } 299 - { 300 - predicate = "-p udp --dport 2049"; 301 - target = "ACCEPT"; 302 - } 303 - { 304 - predicate = "-p tcp --dport 4000:4002"; 305 - target = "ACCEPT"; 306 - } 307 - { 308 - predicate = "-p udp --dport 4000:4002"; 309 - target = "ACCEPT"; 310 - } 311 - ]; 312 - 313 268 tables.nat.PREROUTING.rules = [ 314 269 # transmission rpc port 315 270 { ··· 328 283 pkgs.findutils 329 284 pkgs.inotify-tools 330 285 ]; 331 - startAt = "daily"; 286 + startAt = "hourly"; 332 287 serviceConfig = { 333 288 Type = "oneshot"; 334 289 ExecStart = pkgs.writers.writeDash "flix-index" ''
+8 -19
2configs/services/radio/default.nix
··· 179 179 ''; 180 180 }; 181 181 182 - krebs.iptables = { 183 - tables = { 184 - filter.INPUT.rules = [ 185 - { 186 - predicate = "-p tcp --dport 8000"; 187 - target = "ACCEPT"; 188 - } 189 - { 190 - predicate = "-i retiolum -p tcp --dport 8001"; 191 - target = "ACCEPT"; 192 - } 193 - { 194 - predicate = "-i retiolum -p tcp --dport 8002"; 195 - target = "ACCEPT"; 196 - } 197 - ]; 198 - }; 199 - }; 182 + networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 183 + 8001 184 + 8002 185 + ]; 200 186 201 187 krebs.htgen.radio = { 202 188 port = 8001; ··· 227 213 228 214 security.acme.certs."radio.r".server = config.krebs.ssl.acmeURL; 229 215 230 - networking.firewall.allowedTCPPorts = [ 80 ]; 216 + networking.firewall.allowedTCPPorts = [ 217 + 80 218 + 8000 219 + ]; 231 220 services.nginx = { 232 221 enable = true; 233 222 virtualHosts."radio.r" = {