tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 8 Pull requests Activity

refactor(firewall): Make services responsible for opening ports

Browse source
This commit is contained in:
Tristan Daniël Maat 2025-11-20 00:17:43 +08:00
parent 12790d5444
commit 6bedb95929
Signed by: tlater
GPG key ID: 02E935006CF2E8E7
9 changed files with 63 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

30
configuration/services/conduit/default.nix
View file

@ -17,6 +17,36 @@ in
./matrix-hookshot.nix
];
networking.firewall = {
allowedTCPPorts = [
# These are for "normal" clients
80
443
# Federation happens on 8448
8448
config.services.coturn.listening-port
config.services.coturn.tls-listening-port
config.services.coturn.alt-listening-port
config.services.coturn.alt-tls-listening-port
];
allowedUDPPorts = [
config.services.coturn.listening-port
config.services.coturn.tls-listening-port
config.services.coturn.alt-listening-port
config.services.coturn.alt-tls-listening-port
];
allowedUDPPortRanges = [
{
from = config.services.coturn.min-port;
to = config.services.coturn.max-port;
}
];
};
services = {
matrix-conduit = {
enable = true;