From 869cecc8a0dd9f5af2e36c89ddabe54f25bc2ebc Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <jakub@wilkuu.nl>
Date: Thu, 30 Jul 2026 21:58:26 +0200
Subject: Get inventory to manage monitoring connections

This makes it so you can define the monitoring in the inventory and
tacitus will automatically, pick it up.
---
 hosts/apocalypse/firewall.nix | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

(limited to 'hosts/apocalypse/firewall.nix')

diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix
index f45d4f7..4bc4b32 100644
--- a/hosts/apocalypse/firewall.nix
+++ b/hosts/apocalypse/firewall.nix
@@ -3,6 +3,7 @@ let
   baseTCP = [
     22000 # Syncthng
     5352 # Zeroconf for spotifyd
+    22 # ssh
   ];
   baseUDP = [
     22000 # Syncthing
@@ -24,7 +25,6 @@ let
   ];
 
   secureTCP = [
-    22
     80
     433
     5900 # SSH HTTP VNC
@@ -42,23 +42,28 @@ let
   ];
 in
 {
-  environment.etc.hosts.mode = "0644";
-  networking.nftables.enable = true;
-  networking.firewall = {
-    enable = false;
-    checkReversePath = false;
-    allowedTCPPorts = baseTCP;
-    allowedUDPPorts = baseUDP;
-    allowedUDPPortRanges = baseUDPRanges;
-    allowedTCPPortRanges = baseTCPRanges;
-    interfaces = {
-      "nix-laptop" = {
+  wilkuu.firewall = {
+    enable = true;
+    defaultLayer = "external";
+    layers = {
+      internal = {
         allowedTCPPorts = secureTCP;
         allowedUDPPorts = secureUDP;
         allowedUDPPortRanges = secureUDPRanges;
         allowedTCPPortRanges = secureTCPRanges;
       };
+      external = {
+        allowedTCPPorts = baseTCP;
+        allowedUDPPorts = baseUDP;
+        allowedUDPPortRanges = baseUDPRanges;
+        allowedTCPPortRanges = baseTCPRanges;
+      };
     };
+  };
+  environment.etc.hosts.mode = "0644";
+  networking.nftables.enable = true;
+  networking.firewall = {
+    enable = true;
     trustedInterfaces = [
       "docker0"
       "br-*"
-- 
cgit v1.3.1