summaryrefslogtreecommitdiffstats
path: root/krebs/1systems/ponte/config.nix
diff options
context:
space:
mode:
authorlassulus <lassulus@lassul.us>2022-12-12 16:45:39 +0100
committerlassulus <lassulus@lassul.us>2022-12-12 16:45:39 +0100
commit1775e867524d47b5055034bedadc7a96a4c7da6f (patch)
tree0073823803b051c31491937a621ca53e65adbb9c /krebs/1systems/ponte/config.nix
parentea72339343115c141b432a4f6cd97cfbb0eb1223 (diff)
parent54ddded30dfc02c53baf33c078fafdd9aaf3c70d (diff)
Merge remote-tracking branch 'ni/master'
Diffstat (limited to 'krebs/1systems/ponte/config.nix')
-rw-r--r--krebs/1systems/ponte/config.nix26
1 files changed, 26 insertions, 0 deletions
diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index 8250ebad9..2f55995cf 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -7,5 +7,31 @@
<stockholm/krebs/2configs/matterbridge.nix>
];
+ networking.firewall.allowedTCPPorts = [ 80 443 ];
+ networking.firewall.logRefusedConnections = false;
+ networking.firewall.logRefusedUnicastsOnly = false;
+
+ # Move Internet-facing SSH port to reduce logspam.
+ networking.firewall.extraCommands = let
+ host = config.krebs.build.host;
+ in /* sh */ ''
+ iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT
+ iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+
+ ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT
+ ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+ '';
+
krebs.build.host = config.krebs.hosts.ponte;
+
+ krebs.pages.enable = true;
+ krebs.pages.nginx.addSSL = true;
+ krebs.pages.nginx.enableACME = true;
+
+ security.acme.acceptTerms = true;
+ security.acme.certs.${config.krebs.pages.domain}.email = "spam@krebsco.de";
}