diff options
author | jeschli <jeschli@gmail.com> | 2019-03-21 20:09:09 +0100 |
---|---|---|
committer | jeschli <jeschli@gmail.com> | 2019-03-21 20:09:09 +0100 |
commit | 34bec52f303b0db7af47ae06605ef2bbbcc6b303 (patch) | |
tree | 12b029aee9f63dc2b0b70c280450c240f4183f28 /tv/3modules/iptables.nix | |
parent | a670535cb361a1019034d078c7dc13bc058b5081 (diff) | |
parent | db8d53cefd8f3fae0b48d5a7d175833c8ea408fe (diff) |
Merge branch 'master' of prism.r:stockholm into new-master
Diffstat (limited to 'tv/3modules/iptables.nix')
-rw-r--r-- | tv/3modules/iptables.nix | 59 |
1 files changed, 46 insertions, 13 deletions
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index 56861dc..3974760 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -9,6 +9,37 @@ let { config = lib.mkIf cfg.enable imp; }; + extraTypes = { + rules = types.submodule { + options = { + nat.OUTPUT = mkOption { + type = with types; listOf str; + default = []; + }; + nat.PREROUTING = mkOption { + type = with types; listOf str; + default = []; + }; + nat.POSTROUTING = mkOption { + type = with types; listOf str; + default = []; + }; + filter.FORWARD = mkOption { + type = with types; listOf str; + default = []; + }; + filter.INPUT = mkOption { + type = with types; listOf str; + default = []; + }; + filter.Retiolum = mkOption { + type = with types; listOf str; + default = []; + }; + }; + }; + }; + api = { enable = mkEnableOption "tv.iptables"; @@ -37,19 +68,19 @@ let { default = []; }; - extra = { - nat.POSTROUTING = mkOption { - type = with types; listOf str; - default = []; - }; - filter.FORWARD = mkOption { - type = with types; listOf str; - default = []; - }; - filter.INPUT = mkOption { - type = with types; listOf str; - default = []; - }; + extra = mkOption { + default = {}; + type = extraTypes.rules; + }; + + extra4 = mkOption { + default = {}; + type = extraTypes.rules; + }; + + extra6 = mkOption { + default = {}; + type = extraTypes.rules; }; }; @@ -112,6 +143,7 @@ let { "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" ]} ${formatTable cfg.extra.nat} + ${formatTable cfg."extra${toString iptables-version}".nat} COMMIT *filter :INPUT DROP [0:0] @@ -129,6 +161,7 @@ let { ++ ["-i retiolum -j Retiolum"] )} ${formatTable cfg.extra.filter} + ${formatTable cfg."extra${toString iptables-version}".filter} ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([] ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request ++ map accept-tcp (unique (map toString cfg.input-retiolum-accept-tcp)) |