tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 8 Pull requests Activity

refactor(firewall): Make services responsible for opening ports

Browse source
This commit is contained in:
Tristan Daniël Maat 2025-11-20 00:17:43 +08:00
parent f2ef91672b
commit 86a8df5004
Signed by: tlater
GPG key ID: 02E935006CF2E8E7
9 changed files with 63 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

40
configuration/default.nix
View file

@ -1,9 +1,4 @@
{
config,
modulesPath,
flake-inputs,
...
}:
{ modulesPath, flake-inputs, ... }:
{
imports = [
flake-inputs.disko.nixosModules.disko
@ -49,39 +44,6 @@
networking = {
usePredictableInterfaceNames = false;
useDHCP = false;
firewall = {
allowedTCPPorts = [
# http
80
443
# ssh
2222
# matrix
8448
# starbound
21025
config.services.coturn.listening-port
config.services.coturn.tls-listening-port
config.services.coturn.alt-listening-port
config.services.coturn.alt-tls-listening-port
];
allowedUDPPorts = [
config.services.coturn.listening-port
config.services.coturn.tls-listening-port
config.services.coturn.alt-listening-port
config.services.coturn.alt-tls-listening-port
];
allowedUDPPortRanges = [
{
from = config.services.coturn.min-port;
to = config.services.coturn.max-port;
}
];
};
};
systemd.network.enable = true;