From b394c79051fbcf6cf072f2b9af75819d37cd2426 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 10 Nov 2015 18:53:31 +0100
Subject: m 1 gum:update firewall

---
 makefu/1systems/gum.nix | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

(limited to 'makefu/1systems/gum.nix')

diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix
index a028145ce..3a010220e 100644
--- a/makefu/1systems/gum.nix
+++ b/makefu/1systems/gum.nix
@@ -13,18 +13,36 @@ in {
       # ../2configs/iodined.nix
 
   ];
+
+  krebs.build.target = "root@gum.krebsco.de";
+  krebs.build.host = config.krebs.hosts.gum;
+
+  # Hardware
   boot.loader.grub.device = "/dev/sda";
-  boot.loader.grub.splashImage = null;
   boot.initrd.availableKernelModules = [ "pata_via" "uhci_hcd" ];
   boot.kernelModules = [ "kvm-intel" ];
-  krebs.build.target = "root@gum.krebsco.de";
-  krebs.build.host = config.krebs.hosts.gum;
+
+  # Network
 
   services.udev.extraRules = ''
     SUBSYSTEM=="net", ATTR{address}=="c8:0a:a9:c8:ee:dd", NAME="et0"
   '';
   networking = {
-    firewall.allowPing = true;
+  firewall = {
+      allowPing = true;
+      allowedTCPPorts = [
+        # smtp
+        25
+        # http
+        80 443
+        # tinc
+        655
+      ];
+      allowedUDPPorts = [
+        # tinc
+        655 53
+      ];
+    };
     interfaces.et0.ip4 = [{
       address = external-ip;
       prefixLength = 24;
-- 
cgit v1.2.3