4 files changed, 53 insertions, 51 deletions
diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix
index cb81aa7..238ab09 100644
--- a/hosts/apocalypse/default.nix
+++ b/hosts/apocalypse/default.nix
@@ -13,6 +13,8 @@
     "127.0.0.1" = [ "apocalypse.local" ];
   };
 
+  wilkuu.services.prometheus.enableExporters = true;
+
   services.logind.settings.Login = {
     HandleLidSwitch = "suspend";
     HandleLidSwitchExternalPower = "lock";
diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix
index f45d4f7..4bc4b32 100644
--- a/hosts/apocalypse/firewall.nix
+++ b/hosts/apocalypse/firewall.nix
@@ -3,6 +3,7 @@ let
   baseTCP = [
     22000 # Syncthng
     5352 # Zeroconf for spotifyd
+    22 # ssh
   ];
   baseUDP = [
     22000 # Syncthing
@@ -24,7 +25,6 @@ let
   ];
 
   secureTCP = [
-    22
     80
     433
     5900 # SSH HTTP VNC
@@ -42,23 +42,28 @@ let
   ];
 in
 {
-  environment.etc.hosts.mode = "0644";
-  networking.nftables.enable = true;
-  networking.firewall = {
-    enable = false;
-    checkReversePath = false;
-    allowedTCPPorts = baseTCP;
-    allowedUDPPorts = baseUDP;
-    allowedUDPPortRanges = baseUDPRanges;
-    allowedTCPPortRanges = baseTCPRanges;
-    interfaces = {
-      "nix-laptop" = {
+  wilkuu.firewall = {
+    enable = true;
+    defaultLayer = "external";
+    layers = {
+      internal = {
         allowedTCPPorts = secureTCP;
         allowedUDPPorts = secureUDP;
         allowedUDPPortRanges = secureUDPRanges;
         allowedTCPPortRanges = secureTCPRanges;
       };
+      external = {
+        allowedTCPPorts = baseTCP;
+        allowedUDPPorts = baseUDP;
+        allowedUDPPortRanges = baseUDPRanges;
+        allowedTCPPortRanges = baseTCPRanges;
+      };
     };
+  };
+  environment.etc.hosts.mode = "0644";
+  networking.nftables.enable = true;
+  networking.firewall = {
+    enable = true;
     trustedInterfaces = [
       "docker0"
       "br-*"
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index 0e82fea..8e35fa3 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -1,5 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  inventory,
+  self_name,
+  ...
+}:
 let
+  net = inventory.${self_name}.interfaces;
   wgHomePort = 16888;
   baseTCP = [
     20
@@ -23,16 +30,7 @@ let
 
   secureTCP = [
     # config.wilkuu.services.mysql.port
-  ]
-  ++ lib.mapAttrsToList (_: opt: opt.port) (
-    lib.filterAttrs (
-      _: e:
-      let
-        evaluated = builtins.tryEval e;
-      in
-      evaluated.success && e ? enable && e.enable
-    ) config.services.prometheus.exporters
-  );
+  ];
 
   secureUDP = [
   ];
@@ -63,7 +61,7 @@ in
     useNetworkd = true;
     interfaces = {
       wg-home = {
-        ips = [ "192.168.80.100/24" ];
+        ips = [ "${net.wg-home.ip}/24" ];
         extraOptions = {
           DNS = "192.168.88.1";
         };
@@ -113,24 +111,27 @@ in
     linkConfig.RequiredForOnline = "routable";
   };
 
-  networking.useDHCP = false;
-  networking.useNetworkd = true;
-  networking.nftables.enable = true;
-  networking.firewall = {
+  wilkuu.firewall = {
     enable = true;
-    checkReversePath = false;
-    allowedTCPPorts = baseTCP;
-    allowedUDPPorts = baseUDP;
-    allowedUDPPortRanges = baseUDPRanges;
-    allowedTCPPortRanges = baseTCPRanges;
-    interfaces = {
-      "wg-home" = {
+    defaultLayer = "external";
+    layers = {
+      external = {
+        allowedTCPPorts = baseTCP;
+        allowedUDPPorts = baseUDP;
+        allowedUDPPortRanges = baseUDPRanges;
+        allowedTCPPortRanges = baseTCPRanges;
+      };
+      internal = {
         allowedTCPPorts = secureTCP;
         allowedUDPPorts = secureUDP;
         allowedUDPPortRanges = secureUDPRanges;
         allowedTCPPortRanges = secureTCPRanges;
       };
     };
+  };
+  networking.useDHCP = false;
+  networking.useNetworkd = true;
+  networking.firewall = {
     trustedInterfaces = [
       "docker0"
       "br-*"
diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix
index 513d89c..9b3beef 100644
--- a/hosts/tacitus/network.nix
+++ b/hosts/tacitus/network.nix
@@ -48,27 +48,21 @@ in
       ];
     };
   };
-  networking = {
-    useNetworkd = true;
-    nftables.enable = true;
-    useDHCP = true;
-    firewall = {
-      # check  enable = true;
-      checkReversePath = false;
+
+  wilkuu.firewall = {
+    enable = true;
+    defaultLayer = "internal";
+    layers.internal = {
       allowedTCPPorts = baseTCP;
       allowedUDPPorts = baseUDP;
       allowedUDPPortRanges = baseUDPRanges;
       allowedTCPPortRanges = baseTCPRanges;
-      # TODO: Figure out how to do FW that allows only on the internal ip range
-      #interfaces = {
-      #  "wg-home" = {
-      #   allowedTCPPorts = secureTCP;
-      #   allowedUDPPorts = secureUDP;
-      #   allowedUDPPortRanges = secureUDPRanges;
-      #   allowedTCPPortRanges = secureTCPRanges;
-      # };
-      #};
     };
   };
+  networking = {
+    useNetworkd = true;
+    nftables.enable = true;
+    useDHCP = true;
+  };
 
 }