* Enable the firewall on all machines.
svn path=/configurations/trunk/tud/; revision=34677
Eelco Dolstra committed
Jan 14, 2013 at 16:15 UTC
8ab2ed6b98052bb1510af3c524582729a1a9e92a
4 files changed
+31
-35
cartman.nix
+15
-24
@@ -174,29 +174,23 @@ rec {
174
loader.grub.copyKernels = true;
175
initrd.kernelModules = ["arcmsr"];
176
kernelModules = ["kvm-intel"];
177
- vesa = false; # otherwise "out of sync" on the KVM switch
178
- blacklistedKernelModules = [ "i915" ];
177
};
178
181
- fileSystems =
182
- [ { mountPoint = "/";
183
- label = "nixos";
184
- options = "acl";
185
- }
186
- { mountPoint = "/data/releases";
187
- device = "192.168.1.25:/data/releases";
188
- fsType = "nfs";
189
- options = "soft";
190
- }
191
- { mountPoint = "/backup";
192
- device = "130.161.158.5:/dxs/users4/group/buildfarm";
193
- fsType = "nfs";
194
- }
195
- ];
196
-
197
- swapDevices = [
198
- { label = "swap1"; }
199
- ];
179
+ fileSystems."/" =
180
+ { label = "nixos";
181
+ options = "acl";
182
+ };
183
+ fileSystems."/data/releases" =
184
+ { device = "192.168.1.25:/";
185
+ fsType = "nfs4";
186
+ options = "soft";
187
+ };
188
+ fileSystems."/backup" =
189
+ { device = "130.161.158.5:/dxs/users4/group/buildfarm";
190
+ fsType = "nfs4";
191
+ };
192
+
193
+ swapDevices = [ { label = "swap1"; } ];
194
195
nix = {
196
maxJobs = 2;
@@ -229,11 +223,8 @@ rec {
223
224
extraHosts = "192.168.1.5 cartman";
225
232
- firewall.enable = true;
226
firewall.allowedTCPPorts = [ 80 443 843 10051 5999 ];
227
firewall.allowedUDPPorts = [ 53 67 ];
235
- firewall.rejectPackets = true;
236
- firewall.allowPing = true;
228
firewall.extraCommands =
229
''
230
ip46tables -I nixos-fw-accept -p tcp --dport 843 --syn -j LOG --log-level info --log-prefix "POLICY REQUEST: "
common.nix
+7
-1
@@ -22,7 +22,9 @@ with pkgs.lib;
22
23
boot.supportedFilesystems = [ "nfs" ];
24
25
- boot.blacklistedKernelModules = [ "radeonfb" "radeon" ];
25
+ # Prevent "out of sync" errors on the KVM switch.
26
+ boot.vesa = false;
27
+ boot.blacklistedKernelModules = [ "radeonfb" "radeon" "i915" ];
28
29
boot.initrd.kernelModules = [ "ext4" ];
30
@@ -68,6 +70,10 @@ with pkgs.lib;
70
domain = "st.ewi.tudelft.nl";
71
};
72
73
+ networking.firewall.enable = true;
74
+ networking.firewall.rejectPackets = true;
75
+ networking.firewall.allowPing = true;
76
+
77
# Bump the open files limit so that non-root users can run NixOS VM
78
# tests (Samba opens lot of files).
79
security.pam.loginLimits =
lucifer.nix
+3
-2
@@ -8,6 +8,7 @@
8
environment.systemPackages = [ pkgs.wget ];
9
10
networking.hostName = "lucifer";
11
+ networking.firewall.allowedTCPPorts = [ 2049 3000 4000 ];
12
13
boot.loader.grub.device = "/dev/sda";
14
boot.loader.grub.copyKernels = true;
@@ -33,14 +34,14 @@
34
<!-- End of StatCounter Code -->
35
'';
36
36
- fileSystems =
37
+ fileSystems =
38
[ { mountPoint = "/";
39
label = "nixos";
40
}
41
{ mountPoint = "/fatdata";
42
device = "/dev/fatdisk/fatdata";
43
neededForBoot = true;
43
- }
44
+ }
45
{ mountPoint = "/nix";
46
device = "/fatdata/nix";
47
fsType = "none";
wendy.nix
+6
-8
@@ -12,13 +12,10 @@
12
UseCanonicalName On
13
'';
14
15
- fileSystems =
16
- [ { mountPoint = "/backup";
17
- device = "130.161.158.5:/dxs/users4/group/buildfarm";
18
- fsType = "nfs";
19
- }
20
- ];
21
-
15
+ fileSystems."/backup" =
16
+ { device = "130.161.158.5:/dxs/users4/group/buildfarm";
17
+ fsType = "nfs4";
18
+ };
19
20
jobs.mturk_webserver_production =
21
{ name = "mturk-webserver-production";
@@ -95,7 +92,7 @@
92
host hydra_test hydra 192.168.1.26/32 md5
93
host mediawiki mediawiki 192.168.1.5/32 md5
94
host zabbix zabbix 192.168.1.5/32 md5
98
- '';
95
+ '';
96
};
97
98
# Bump kernel.shmmax for PostgreSQL. FIXME: this should be a NixOS
@@ -121,4 +118,5 @@
118
];
119
};
120
121
+ networking.firewall.allowedTCPPorts = [ 80 3000 3001 5432 ];
122
}