From 512f90d10096e81180730374d5d9664384894807 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 26 Dec 2016 13:29:06 +0100 Subject: l 2 libvirt: add lass to libvirtd --- lass/2configs/libvirt.nix | 20 ++------------------ 1 file changed, 2 insertions(+), 18 deletions(-) (limited to 'lass/2configs/libvirt.nix') diff --git a/lass/2configs/libvirt.nix b/lass/2configs/libvirt.nix index e739d2f79..8c095bb01 100644 --- a/lass/2configs/libvirt.nix +++ b/lass/2configs/libvirt.nix @@ -1,23 +1,7 @@ { config, lib, pkgs, ... }: -let - mainUser = config.users.extraUsers.mainUser; - inherit (import ) genid; - -in { +{ + users.users.mainUser.extraGroups = [ "libvirtd" ]; virtualisation.libvirtd.enable = true; - users.extraUsers = { - libvirt = { - uid = genid "libvirt"; - description = "user for running libvirt stuff"; - home = "/home/libvirt"; - useDefaultShell = true; - extraGroups = [ "libvirtd" "audio" ]; - createHome = true; - }; - }; - security.sudo.extraConfig = '' - ${mainUser.name} ALL=(libvirt) NOPASSWD: ALL - ''; } -- cgit v1.2.3 From 205d0f0d21c0f62aac0590873a6741415f9416fa Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 26 Dec 2016 13:29:39 +0100 Subject: l 2 libvirt: add iptables config for NAT --- lass/2configs/libvirt.nix | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'lass/2configs/libvirt.nix') diff --git a/lass/2configs/libvirt.nix b/lass/2configs/libvirt.nix index 8c095bb01..a71638323 100644 --- a/lass/2configs/libvirt.nix +++ b/lass/2configs/libvirt.nix @@ -4,4 +4,27 @@ users.users.mainUser.extraGroups = [ "libvirtd" ]; virtualisation.libvirtd.enable = true; + krebs.iptables.tables.filter.INPUT.rules = [ + { v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 53"; target = "ACCEPT"; } + { v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 53"; target = "ACCEPT"; } + { v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 67"; target = "ACCEPT"; } + { v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 67"; target = "ACCEPT"; } + ]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { v6 = false; predicate = "-d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } + { v6 = false; predicate = "-s 192.168.122.0/24 -i virbr0"; target = "ACCEPT"; } + { v6 = false; predicate = "-i virbr0 -o virbr0"; target = "ACCEPT"; } + { v6 = false; predicate = "-o virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; } + { v6 = false; predicate = "-i virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; } + ]; + krebs.iptables.tables.filter.OUTPUT.rules = [ + { v6 = false; predicate = "-o virbr0 -p udp -m udp --dport 68"; target = "ACCEPT"; } + ]; + krebs.iptables.tables.nat.POSTROUTING.rules = [ + { v6 = false; predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24"; target = "RETURN"; } + { v6 = false; predicate = "-s 192.168.122.0/24 -d 255.255.255.255"; target = "RETURN"; } + { v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24"; target = "MASQUERADE"; } + { v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; } + { v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; } + ]; } -- cgit v1.2.3