From 869cecc8a0dd9f5af2e36c89ddabe54f25bc2ebc Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <jakub@wilkuu.nl>
Date: Thu, 30 Jul 2026 21:58:26 +0200
Subject: Get inventory to manage monitoring connections

This makes it so you can define the monitoring in the inventory and
tacitus will automatically, pick it up.
---
 hosts/omega-relay/firewall.nix | 47 +++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 23 deletions(-)

(limited to 'hosts/omega-relay/firewall.nix')

diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index 0e82fea..8e35fa3 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -1,5 +1,12 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  inventory,
+  self_name,
+  ...
+}:
 let
+  net = inventory.${self_name}.interfaces;
   wgHomePort = 16888;
   baseTCP = [
     20
@@ -23,16 +30,7 @@ let
 
   secureTCP = [
     # config.wilkuu.services.mysql.port
-  ]
-  ++ lib.mapAttrsToList (_: opt: opt.port) (
-    lib.filterAttrs (
-      _: e:
-      let
-        evaluated = builtins.tryEval e;
-      in
-      evaluated.success && e ? enable && e.enable
-    ) config.services.prometheus.exporters
-  );
+  ];
 
   secureUDP = [
   ];
@@ -63,7 +61,7 @@ in
     useNetworkd = true;
     interfaces = {
       wg-home = {
-        ips = [ "192.168.80.100/24" ];
+        ips = [ "${net.wg-home.ip}/24" ];
         extraOptions = {
           DNS = "192.168.88.1";
         };
@@ -113,24 +111,27 @@ in
     linkConfig.RequiredForOnline = "routable";
   };
 
-  networking.useDHCP = false;
-  networking.useNetworkd = true;
-  networking.nftables.enable = true;
-  networking.firewall = {
+  wilkuu.firewall = {
     enable = true;
-    checkReversePath = false;
-    allowedTCPPorts = baseTCP;
-    allowedUDPPorts = baseUDP;
-    allowedUDPPortRanges = baseUDPRanges;
-    allowedTCPPortRanges = baseTCPRanges;
-    interfaces = {
-      "wg-home" = {
+    defaultLayer = "external";
+    layers = {
+      external = {
+        allowedTCPPorts = baseTCP;
+        allowedUDPPorts = baseUDP;
+        allowedUDPPortRanges = baseUDPRanges;
+        allowedTCPPortRanges = baseTCPRanges;
+      };
+      internal = {
         allowedTCPPorts = secureTCP;
         allowedUDPPorts = secureUDP;
         allowedUDPPortRanges = secureUDPRanges;
         allowedTCPPortRanges = secureTCPRanges;
       };
     };
+  };
+  networking.useDHCP = false;
+  networking.useNetworkd = true;
+  networking.firewall = {
     trustedInterfaces = [
       "docker0"
       "br-*"
-- 
cgit v1.3.1