firewall

5 files changed, 61 insertions, 15 deletions

diff --git a/home-manager/modules/services/syncthing.nix b/home-manager/modules/services/syncthing.nix
index 06b94a2..8679947 100644
--- a/home-manager/modules/services/syncthing.nix
+++ b/home-manager/modules/services/syncthing.nix
@@ -2,6 +2,7 @@
 {
   services.syncthing = {
     enable = true; 
+    openDefaultPorts = true; 
   };  
 }
 
diff --git a/nixos/hosts/apocalypse/backup.nix b/nixos/hosts/apocalypse/backup.nix
index de22bd3..646ff6c 100644
--- a/nixos/hosts/apocalypse/backup.nix
+++ b/nixos/hosts/apocalypse/backup.nix
@@ -1,28 +1,25 @@
 { config, lib, pkgs, modulesPath, ...}:
 {
+  environment.systemPackages = with pkgs; [
+    btrbk
+    lz4
+  ];
+  
   services.btrbk = {
+  extraPackages = with pkgs; [ lz4 ];
   instances."remote_vault" = {
     onCalendar = "weekly";
     settings = {
-      ssh_identity = "/etc/btrbk_key"; # NOTE: must be readable by user/group btrbk
-      ssh_user = "vault";
+      ssh_identity = "/etc/vault_key"; # NOTE: must be readable by user/group btrbk
+      ssh_user = "vaultmanager";
       stream_compress = "lz4";
       volume."/btrfs_root" = {
         target = "ssh://10.100.0.1/vault/backups/apocalypse";
         subvolume = { 
-          nixos = { 
+          "@root" = { 
             snapshot_create = "always";
           };  
         };
-        # "nixos" could instead be an attribute set with other volumes to
-        # back up and to give subvolume specific configuration.
-        # See man btrbk.conf for possible options.
-        /*
-        subvolume = {
-          home = { snapshot_create = "always"; };
-          nixos = {};
-        };
-        */
       };
     };
   };
diff --git a/nixos/hosts/apocalypse/default.nix b/nixos/hosts/apocalypse/default.nix
index 129bdbc..a84d07d 100644
--- a/nixos/hosts/apocalypse/default.nix
+++ b/nixos/hosts/apocalypse/default.nix
@@ -4,6 +4,8 @@
      ./hardware-configuration.nix
      ../../common
      ./nvidia.nix
+     ./backup.nix
+     ./firewall.nix
    ];
    boot.loader.grub = { 
         useOSProber = true;
@@ -33,7 +35,6 @@
   boot.consoleLogLevel = 0; 
 
   networking.hostName = "apocalypse"; # Define your hostname.
-  networking.firewall.enable = false;
   networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
   
   hardware.bluetooth.enable = true; 
diff --git a/nixos/hosts/apocalypse/firewall.nix b/nixos/hosts/apocalypse/firewall.nix
new file mode 100644
index 0000000..2068d55
--- /dev/null
+++ b/nixos/hosts/apocalypse/firewall.nix
@@ -0,0 +1,47 @@
+{pkgs, config, ...}:
+let 
+  baseTCP = [
+    
+  ]; 
+  baseUDP = [
+    16555 # Wireguard
+  ]; 
+  baseTCPRanges = [
+    { from = 1714; to = 1764; } # KDE-CONNECT 
+  ];
+  baseUDPRanges = [
+    { from = 1714; to = 1764; } # KDE-CONNECT 
+  ];
+
+  secureTCP = [
+    22 80 433 5900
+  ] ++ baseTCP;  
+  
+  secureUDP = [
+    
+  ] ++ baseUDP;  
+
+  secureTCPRanges = [
+
+  ] ++ baseTCPRanges ; 
+  secureUDPRanges = [
+
+  ] ++ baseUDPRanges; 
+in 
+{
+    networking.firewall {
+        enable = true; 
+        allowedTCPPorts = baseTCP; 
+        allowedUDPPorts = baseUDP; 
+          allowedUDPPortRanges = baseUDPRanges;
+          allowedTCPPortRanges = baseTCPRanges;
+        interfaces = {
+        "wg0" = {
+          allowedTCPPorts = secureTCP; 
+          allowedUDPorts = secureUDP; 
+          allowedUDPPortRanges = secureUDPRanges;
+          allowedTCPPortRanges = secureTCPRanges;
+        };
+    };
+}
+
diff --git a/nixos/hosts/apocalypse/hardware-configuration.nix b/nixos/hosts/apocalypse/hardware-configuration.nix
index 1133dc6..d8ae434 100644
--- a/nixos/hosts/apocalypse/hardware-configuration.nix
+++ b/nixos/hosts/apocalypse/hardware-configuration.nix
@@ -33,8 +33,8 @@ menuentry 'UEFI Firmware' $menuentry_id_option 'uefi-firmware' {
 
   fileSystems."/btrfs_root" = {
       device = "/dev/mapper/cryptroot";
-      fsType = "btrfs"
-      options = [ "subvolid=5", "compress=zstd"]
+      fsType = "btrfs";
+      options = [ "subvolid=5" "compress=zstd"];
   };