summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--0make/lass/mors.makefile2
-rw-r--r--1systems/lass/mors.nix6
-rw-r--r--1systems/lass/uriel.nix6
-rw-r--r--2configs/lass/git-repos.nix10
-rw-r--r--2configs/lass/ircd.nix4
-rw-r--r--2configs/lass/steam.nix1
-rw-r--r--3modules/lass/iptables.nix65
7 files changed, 71 insertions, 23 deletions
diff --git a/0make/lass/mors.makefile b/0make/lass/mors.makefile
index 892bc2e06..896466a6f 100644
--- a/0make/lass/mors.makefile
+++ b/0make/lass/mors.makefile
@@ -1,4 +1,4 @@
deploy_host := root@mors
nixpkgs_url := https://github.com/Lassulus/nixpkgs
-nixpkgs_rev := 961fcbabd7643171ea74bd550fee1ce5c13c2e90
+nixpkgs_rev := 1879a011925c561f0a7fd4043da0768bbff41d0b
secrets_dir := /home/lass/secrets/mors
diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index f724decca..940dc4fdb 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -33,6 +33,12 @@
];
};
}
+ {
+ imports = [ ../../3modules/tv/identity.nix ];
+ tv.identity = {
+ enable = true;
+ };
+ }
];
networking.hostName = "mors";
diff --git a/1systems/lass/uriel.nix b/1systems/lass/uriel.nix
index b8fa899ba..25745d055 100644
--- a/1systems/lass/uriel.nix
+++ b/1systems/lass/uriel.nix
@@ -24,6 +24,12 @@
];
};
}
+ {
+ imports = [ ../../3modules/tv/identity.nix ];
+ tv.identity = {
+ enable = true;
+ };
+ }
];
networking.hostName = "uriel";
diff --git a/2configs/lass/git-repos.nix b/2configs/lass/git-repos.nix
index 94ab6317d..c0c305b85 100644
--- a/2configs/lass/git-repos.nix
+++ b/2configs/lass/git-repos.nix
@@ -121,10 +121,20 @@ in
{
imports = [
../../3modules/tv/git.nix
+ ../../3modules/lass/iptables.nix
];
tv.git = {
enable = true;
inherit repos rules users;
};
+
+ lass.iptables = {
+ tables = {
+ filter.INPUT.rules = [
+ { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
+ ];
+ };
+ };
+
}
diff --git a/2configs/lass/ircd.nix b/2configs/lass/ircd.nix
index c57f7dd5c..f71b769fd 100644
--- a/2configs/lass/ircd.nix
+++ b/2configs/lass/ircd.nix
@@ -83,6 +83,10 @@
channel_target_change = yes;
disable_local_channels = no;
};
+ general {
+ #maybe we want ident someday?
+ disable_auth = yes;
+ };
'';
};
}
diff --git a/2configs/lass/steam.nix b/2configs/lass/steam.nix
index d54873b1f..7d088fc6a 100644
--- a/2configs/lass/steam.nix
+++ b/2configs/lass/steam.nix
@@ -12,6 +12,7 @@
##TODO: make steam module
hardware.opengl.driSupport32Bit = true;
+ nixpkgs.config.steam.java = true;
environment.systemPackages = with pkgs; [
steam
];
diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix
index 6d567ca23..c97b9f730 100644
--- a/3modules/lass/iptables.nix
+++ b/3modules/lass/iptables.nix
@@ -2,7 +2,28 @@ arg@{ config, lib, pkgs, ... }:
let
inherit (pkgs) writeScript writeText;
- inherit (lib) concatMapStringsSep concatStringsSep attrNames unique fold any attrValues catAttrs filter flatten length hasAttr mkEnableOption mkOption mkIf types;
+
+ inherit (lib)
+ concatMapStringsSep
+ concatStringsSep
+ attrNames
+ unique
+ fold
+ any
+ attrValues
+ catAttrs
+ filter
+ flatten
+ length
+ hasAttr
+ mkEnableOption
+ mkOption
+ mkIf
+ types
+ sort;
+
+ elemIsIn = a: as:
+ any (x: x == a) as;
cfg = config.lass.iptables;
@@ -74,38 +95,38 @@ let
};
};
- #buildTable :: iptablesAttrSet` -> str
+ #buildTable :: iptablesVersion -> iptablesAttrSet` -> str
#todo: differentiate by iptables-version
- buildTables = iptv: ts:
+ buildTables = v: ts:
let
+
declareChain = t: cn:
#TODO: find out what to do whit these count numbers
":${cn} ${t."${cn}".policy} [0:0]";
buildChain = tn: cn:
- #"${concatStringsSep " " ((attrNames t."${cn}") ++ [cn])}";
-
- #TODO: sort by precedence
- #TODO: double check should be unneccessary, refactor!
- if (hasAttr "rules" ts."${tn}"."${cn}") then
- if (ts."${tn}"."${cn}".rules == null) then
- ""
+ let
+ sortedRules = sort (a: b: a.precedence < b.precedence) ts."${tn}"."${cn}".rules;
+
+ in
+ #TODO: double check should be unneccessary, refactor!
+ if (hasAttr "rules" ts."${tn}"."${cn}") then
+ if (ts."${tn}"."${cn}".rules == null) then
+ ""
+ else
+ concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([]
+ ++ map (buildRule tn cn) sortedRules
+ )
else
- concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([]
- ++ map buildRule ts."${tn}"."${cn}".rules
- )
- else
- ""
- ;
+ ""
+ ;
- buildRule = rule:
- #TODO implement rule validation-test here
- #
- #target:
- #target needs to be an existing chain (in the same table) or ACCEPT, REJECT, DROP, LOG, QUEUE, RETURN
+ buildRule = tn: cn: rule:
+ #target validation test:
+ assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ (attrNames ts."${tn}")));
- #predicate:
+ #predicate validation test:
#maybe use iptables-test
#TODO: howto exit with evaluation error by shellscript?
#apperantly not possible from nix because evalatution wouldn't be deterministic.