From d3ed4dec9c77b9453e4a7d1eb043c9b70c173388 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 6 Jun 2023 15:30:02 +0200
Subject: tv sshd: admit hosts without IPv4 addresses

---
 tv/2configs/sshd.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to 'tv/2configs')

diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix
index 33856ac12..0610e3c98 100644
--- a/tv/2configs/sshd.nix
+++ b/tv/2configs/sshd.nix
@@ -9,10 +9,14 @@ in {
   tv.iptables.extra.nat.OUTPUT = [
     "-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22"
   ];
-  tv.iptables.extra4.nat.PREROUTING = [
-    "-d ${cfg.host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT"
-    "-d ${cfg.host.nets.wiregrill.ip4.addr} -p tcp --dport 22 -j ACCEPT"
-  ];
+  tv.iptables.extra4.nat.PREROUTING =
+    map
+      (net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT")
+      (filter (net: net.ip4 != null)
+              [
+                cfg.host.nets.retiolum
+                cfg.host.nets.wiregrill
+              ]);
   tv.iptables.extra6.nat.PREROUTING = [
     "-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT"
     "-d ${cfg.host.nets.wiregrill.ip6.addr} -p tcp --dport 22 -j ACCEPT"
-- 
cgit v1.2.3