jawz/NixOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

modularized firewall logic

Browse Source
This commit is contained in:
Danilo Reyes 2025-09-27 17:44:01 -06:00
parent 3d3f49aeec
commit 99574c9b66
27 changed files with 31 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
config/base.nix
View File

@ -1,5 +1,4 @@
{
self,
lib,
pkgs,
inputs,

1
hosts/server/configuration.nix
View File

@ -1,7 +1,6 @@
{
pkgs,
config,
lib,
...
}:
{

1
hosts/workstation/configuration.nix
View File

@ -1,6 +1,5 @@
{
pkgs,
inputs,
...
}:
let

24
modules/factories/server-factory.nix
View File

@ -1,24 +0,0 @@
{
lib,
config,
name,
subdomain,
port,
serviceConfig ? { },
nginxConfig ? null,
}:
let
cfg = config.my.servers.${name};
setup = import ./setup.nix { inherit lib config; };
in
{
options.my.servers.${name} = setup.mkOptions name subdomain port;
config = lib.mkIf cfg.enable {
services = serviceConfig // {
nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (
if nginxConfig != null then nginxConfig cfg else setup.proxyReverseFix cfg
);
};
};
}

31
modules/network/firewall.nix
View File

@ -1,4 +1,28 @@
{ lib, config, ... }:
let
nativeServicesWithOpenFirewall = [
"adguardhome"
"plex"
"sabnzbd"
"nix-serve"
"radarr"
"sonarr"
"jellyfin"
"prowlarr"
"bazarr"
"stash"
"ombi"
"flaresolverr"
];
servicesConfig = lib.listToAttrs (
map (serviceName: {
name = serviceName;
value.openFirewall = config.my.servers.${serviceName}.enable or false;
}) nativeServicesWithOpenFirewall
);
in
{
options.my.network.firewall = {
enabledServicePorts = lib.mkEnableOption "auto-open ports for enabled services";
@ -15,12 +39,17 @@
};
config = lib.mkIf config.my.network.firewall.enabledServicePorts {
services = servicesConfig;
networking.firewall.allowedTCPPorts =
config.my.network.firewall.staticPorts
++ config.my.network.firewall.additionalPorts
++ (
config.my.servers
|> lib.filterAttrs (_: srv: (srv.enable or false) && (srv ? port))
|> lib.filterAttrs (
name: srv:
(srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServicesWithOpenFirewall)
)
|> lib.attrValues
|> map (srv: srv.port)
)

1
modules/servers/adguardhome.nix
View File

@ -5,7 +5,6 @@
services.adguardhome = {
enable = true;
mutableSettings = true;
openFirewall = true;
};
};
}

1
modules/servers/bazarr.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.bazarr = setup.mkOptions "bazarr" "subs" config.services.bazarr.listenPort;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
services = {
bazarr = lib.mkIf cfg.enable {
enable = true;

1
modules/servers/homepage.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.homepage = setup.mkOptions "homepage" "home" 8082;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
sops.secrets = lib.mkIf cfg.enable {
homepage.sopsFile = ../../secrets/homepage.yaml;
"private-ca/pem" = {

1
modules/servers/jellyfin.nix
View File

@ -24,7 +24,6 @@ in
{
options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
environment = {
systemPackages = lib.mkIf cfg.enable (
[ pkgs.jellyfin-ffmpeg ] ++ (lib.optional cfg.enableCron [ sub-sync-path ])

1
modules/servers/kavita.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.kavita = setup.mkOptions "kavita" "library" config.services.kavita.settings.Port;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
sops.secrets.kavita-token = lib.mkIf cfg.enable {
owner = config.users.users.kavita.name;
inherit (config.users.users.kavita) group;

1
modules/servers/lidarr.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
autoStart = true;
image = "linuxserver/lidarr:version-2.13.3.4711";

1
modules/servers/maloja.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.maloja = setup.mkOptions "maloja" "maloja" 42010;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
sops.secrets = lib.mkIf cfg.enable { maloja.sopsFile = ../../secrets/env.yaml; };
virtualisation.oci-containers.containers.maloja = lib.mkIf cfg.enable {
image = "krateng/maloja:3.2.3";

1
modules/servers/mealie.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.mealie = setup.mkOptions "mealie" "mealie" 9925;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
sops.secrets = lib.mkIf cfg.enable { mealie.sopsFile = ../../secrets/env.yaml; };
services = {
mealie = lib.mkIf cfg.enable {

1
modules/servers/metube.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
image = "ghcr.io/alexta69/metube:2024-11-05";
ports = [ "${toString cfg.port}:8081" ];

1
modules/servers/microbin.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.microbin = setup.mkOptions "microbin" "copy" 8086;
config = lib.mkIf config.my.servers.microbin.enable {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
services = {
microbin = lib.mkIf cfg.enable {
enable = true;

1
modules/servers/multi-scrobbler.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.multi-scrobbler = setup.mkOptions "multi-scrobbler" "scrobble" 9078;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
sops.secrets = lib.mkIf cfg.enable { multi-scrobbler.sopsFile = ../../secrets/env.yaml; };
virtualisation.oci-containers.containers.multi-scrobbler = lib.mkIf cfg.enable {
image = "foxxmd/multi-scrobbler:0.9.11";

1
modules/servers/nix-serve.nix
View File

@ -15,7 +15,6 @@ in
services = {
nix-serve = {
enable = true;
openFirewall = true;
package = pkgs.nix-serve-ng;
inherit (cfg) port;
secretKeyFile = config.sops.secrets."private_cache_keys/miniserver".path;

1
modules/servers/ombi.nix
View File

@ -9,7 +9,6 @@ in
ombi = lib.mkIf cfg.enable {
enable = true;
inherit (cfg) port;
openFirewall = !cfg.isLocal;
};
nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
};

1
modules/servers/plex.nix
View File

@ -13,7 +13,6 @@ in
plex = lib.mkIf cfg.enable {
enable = true;
group = "piracy";
openFirewall = true;
};
nginx = lib.mkIf cfg.enableProxy {
virtualHosts."${cfg.host}" = {

7
modules/servers/prowlarr.nix
View File

@ -1,5 +1,4 @@
{
pkgs,
lib,
config,
...
@ -11,17 +10,13 @@ in
{
options.my.servers.prowlarr = setup.mkOptions "prowlarr" "indexer" 9696;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
users.users.prowlarr = lib.mkIf cfg.enable {
group = "piracy";
isSystemUser = true;
};
services = {
prowlarr.enable = cfg.enable;
flaresolverr = {
inherit (cfg) enable;
openFirewall = true;
};
flaresolverr.enable = cfg.enable;
nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
};
};

1
modules/servers/radarr.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.radarr = setup.mkOptions "radarr" "movies" 7878;
config = {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
services = {
radarr = lib.mkIf cfg.enable {
enable = true;

2
modules/servers/sabnzbd.nix
View File

@ -9,11 +9,9 @@
};
};
config = lib.mkIf config.my.servers.sabnzbd.enable {
networking.firewall.allowedTCPPorts = [ config.my.servers.sabnzbd.port ];
services.sabnzbd = {
enable = true;
group = "piracy";
openFirewall = true;
};
};
}

1
modules/servers/shiori.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.shiori = setup.mkOptions "shiori" "bookmarks" 4368;
config = lib.mkIf (config.my.servers.shiori.enable && config.my.servers.postgres.enable) {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
sops.secrets = lib.mkIf cfg.enable { shiori.sopsFile = ../../secrets/env.yaml; };
services = {
shiori = lib.mkIf cfg.enable {

1
modules/servers/sonarr.nix
View File

@ -9,7 +9,6 @@ in
sonarr = lib.mkIf cfg.enable {
enable = true;
group = "piracy";
openFirewall = !cfg.isLocal;
};
nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
};

1
modules/servers/stash.nix
View File

@ -15,7 +15,6 @@ in
stash = lib.mkIf cfg.enable {
enable = true;
group = "piracy";
openFirewall = !cfg.isLocal;
mutableSettings = true;
username = "Suing8150";
passwordFile = config.sops.secrets."stash/password".path;

1
modules/servers/tranga.nix
View File

@ -6,7 +6,6 @@ in
{
options.my.servers.tranga = setup.mkOptions "tranga" "tranga" 9555;
config = {
networking.firewall.allowedTCPPorts = [ cfg.port ];
virtualisation.oci-containers.containers = lib.mkIf cfg.enable {
tranga-api = {
image = "glax/tranga-api:latest";

1
modules/servers/vaultwarden.nix
View File

@ -11,7 +11,6 @@ in
{
options.my.servers.vaultwarden = setup.mkOptions "vaultwarden" "vault" 8222;
config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable) {
networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
sops.secrets = lib.mkIf cfg.enable { vaultwarden.sopsFile = ../../secrets/env.yaml; };
services = {
vaultwarden = lib.mkIf cfg.enable {