all repos — nixfiles @ 80ebdb01e24988de91500d062b825853352a31e5

System and user configuration, managed by nix and home-manager

extract and reduce firewall config

Alin
commit

80ebdb01e24988de91500d062b825853352a31e5

parent

78d75774511324aef146b92cdfc353f9f852823e

4 files changed, 8 insertions(+), 34 deletions(-)

changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -191,26 +191,14 @@ ];
       };
     };
     firewall = {
-      enable = true;
-      allowPing = true;
-      pingLimit = "--limit 60/minute --limit-burst 30";
-      logRefusedConnections = false;
       allowedTCPPorts = [
-        22
-        80
-        443
         53
         853
         6379
         9418
-        6922
       ];
       allowedUDPPorts = [
         53
-        443 # HTTP/3 (QUIC)
-        3478
-        6885 # DHT
-        6922
       ];
       trustedInterfaces = [
         "podman0"
M system/hosts/smrk.nix → system/hosts/smrk.nix
@@ -33,28 +33,6 @@
   networking = {
     hostName = hostname;
     domain = domain;
-
-    nameservers = [
-      "2606:4700:4700::1111"
-      "2606:4700:4700::1001"
-      "1.1.1.1"
-      "1.0.0.1"
-    ];
-
-    firewall = {
-      enable = true;
-      allowPing = true;
-      pingLimit = "--limit 60/minute --limit-burst 30";
-      logRefusedConnections = false;
-      allowedTCPPorts = [
-        22
-        80
-        443
-      ];
-      allowedUDPPorts = [
-        443
-      ];
-    };
   };
 
   nix = {
M system/roles/base.nix → system/roles/base.nix
@@ -5,4 +5,11 @@ ../settings/programs/neovim.nix
     ../settings/programs/shell.nix
     ../settings/programs/base.nix
   ];
+
+  networking = {
+    firewall = {
+      pingLimit = "--limit 60/minute --limit-burst 30";
+      logRefusedConnections = false;
+    };
+  };
 }
M system/settings/services/caddy.nix → system/settings/services/caddy.nix
@@ -11,6 +11,7 @@ users.groups.acme.members = [ "caddy" ];
 
   services.caddy = {
     enable = true;
+    openFirewall = true;
     group = "caddy";
     virtualHosts = {
       "http://" = {