From ca1d6b3588395f3e940fcaefc0914777db33ca38 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 28 Nov 2016 13:06:00 +0100 Subject: l 3 iptables: set defaults correctly --- krebs/3modules/iptables.nix | 30 +++++------------------------- 1 file changed, 5 insertions(+), 25 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/iptables.nix b/krebs/3modules/iptables.nix index a4a4de6f9..09b493c20 100644 --- a/krebs/3modules/iptables.nix +++ b/krebs/3modules/iptables.nix @@ -29,9 +29,10 @@ let tables = mkOption { type = with types; attrsOf (attrsOf (submodule ({ options = { + #TODO: find out good defaults. policy = mkOption { type = str; - default = "-"; + default = "ACCEPT"; }; rules = mkOption { type = nullOr (listOf (submodule ({ @@ -133,30 +134,9 @@ let #===== rules = iptables-version: - let - #TODO: find out good defaults. - tables-defaults = { - nat.PREROUTING.policy = "ACCEPT"; - nat.INPUT.policy = "ACCEPT"; - nat.OUTPUT.policy = "ACCEPT"; - nat.POSTROUTING.policy = "ACCEPT"; - filter.INPUT.policy = "ACCEPT"; - filter.FORWARD.policy = "ACCEPT"; - filter.OUTPUT.policy = "ACCEPT"; - - #if someone specifies any other rules on this chain, the default rules get lost. - #is this wanted beahiviour or a bug? - #TODO: implement abstraction of rules - filter.INPUT.rules = [ - { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } - ]; - }; - tables = tables-defaults // cfg.tables; - - in - pkgs.writeText "krebs-iptables-rules${iptables-version}" '' - ${buildTables iptables-version tables} - ''; + pkgs.writeText "krebs-iptables-rules${iptables-version}" '' + ${buildTables iptables-version cfg.tables} + ''; startScript = pkgs.writeDash "krebs-iptables_start" '' set -euf -- cgit v1.2.3 From 61c38e4c2dca1c55d80b87bc7c09b00337ca9f38 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 1 Dec 2016 16:57:29 +0100 Subject: k 3: remove Mic92 from eloop-ml --- krebs/3modules/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 7f5d2c7bd..bf09b7424 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -155,14 +155,13 @@ let to = concatMapStringsSep "," (getAttr "mail") (toList to); }; in mapAttrsToList format (with config.krebs.users; let - eloop-ml = spam-ml ++ [ ciko Mic92 ]; + eloop-ml = spam-ml ++ [ ciko ]; spam-ml = [ lass makefu tv ]; ciko.mail = "wieczorek.stefan@gmail.com"; - Mic92.mail = "joerg@higgsboson.tk"; in { "anmeldung@eloop.org" = eloop-ml; "cfp@eloop.org" = eloop-ml; -- cgit v1.2.3