From 72a532244594a370f597babf700fb013123d8c17 Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <j.stachurski@student.utwente.nl>
Date: Wed, 5 Nov 2025 01:29:41 +0100
Subject: Secrets via nixos-sops, caldav and fixed virt

---
 hosts/apocalypse/default.nix  | 8 --------
 hosts/apocalypse/firewall.nix | 9 ++++++++-
 2 files changed, 8 insertions(+), 9 deletions(-)

(limited to 'hosts/apocalypse')

diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix
index d199263..c4bffbf 100644
--- a/hosts/apocalypse/default.nix
+++ b/hosts/apocalypse/default.nix
@@ -61,7 +61,6 @@
 
   programs.nix-ld.enable = true;
   services.printing.enable = true;
-  # nix.config.allowUnfree = true; 
 
 
 	services.resolved = {
@@ -96,13 +95,6 @@
       PrintMotd = true;
     }; 
   };
-
-   # Winbox setup.
-  programs.winbox = {
-    enable = true;
-    openFirewall = true;
-    package = pkgs.winbox;
-  };
 }
 
 
diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix
index c63e556..26097af 100644
--- a/hosts/apocalypse/firewall.nix
+++ b/hosts/apocalypse/firewall.nix
@@ -33,8 +33,10 @@ let
   ]; 
 in 
 {
+    networking.nftables.enable = false; 
     networking.firewall = {
-        enable = false; 
+        enable = false;
+        checkReversePath = false; 
         allowedTCPPorts = baseTCP; 
         allowedUDPPorts = baseUDP; 
           allowedUDPPortRanges = baseUDPRanges;
@@ -47,6 +49,11 @@ in
             allowedTCPPortRanges = secureTCPRanges;
           };
        };
+       trustedInterfaces = [
+          "docker0" 
+          "br-*" 
+          "veth*"
+       ];
     };
 }
 
-- 
cgit v1.3.1