From 869cecc8a0dd9f5af2e36c89ddabe54f25bc2ebc Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <jakub@wilkuu.nl>
Date: Thu, 30 Jul 2026 21:58:26 +0200
Subject: Get inventory to manage monitoring connections

This makes it so you can define the monitoring in the inventory and
tacitus will automatically, pick it up.
---
 hosts/tacitus/network.nix | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

(limited to 'hosts/tacitus')

diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix
index 513d89c..9b3beef 100644
--- a/hosts/tacitus/network.nix
+++ b/hosts/tacitus/network.nix
@@ -48,27 +48,21 @@ in
       ];
     };
   };
-  networking = {
-    useNetworkd = true;
-    nftables.enable = true;
-    useDHCP = true;
-    firewall = {
-      # check  enable = true;
-      checkReversePath = false;
+
+  wilkuu.firewall = {
+    enable = true;
+    defaultLayer = "internal";
+    layers.internal = {
       allowedTCPPorts = baseTCP;
       allowedUDPPorts = baseUDP;
       allowedUDPPortRanges = baseUDPRanges;
       allowedTCPPortRanges = baseTCPRanges;
-      # TODO: Figure out how to do FW that allows only on the internal ip range
-      #interfaces = {
-      #  "wg-home" = {
-      #   allowedTCPPorts = secureTCP;
-      #   allowedUDPPorts = secureUDP;
-      #   allowedUDPPortRanges = secureUDPRanges;
-      #   allowedTCPPortRanges = secureTCPRanges;
-      # };
-      #};
     };
   };
+  networking = {
+    useNetworkd = true;
+    nftables.enable = true;
+    useDHCP = true;
+  };
 
 }
-- 
cgit v1.3.1