nftables: create shared base module
Martin Weinelt committed
Sep 21, 2025 at 16:55 UTC
dbfb853764deae227be590f63258dc1d73335583
3 files changed
+34
-14
build/common.nix
+1
-12
@@ -8,6 +8,7 @@
8
imports = [
9
./diffoscope.nix
10
../modules/common.nix
11
+ ../modules/nftables.nix
12
../modules/prometheus
13
../modules/rasdaemon.nix
14
../modules/wireguard.nix
@@ -79,18 +80,6 @@
80
# we use networkd
81
networking.useDHCP = false;
82
82
- networking.nftables.enable = true;
83
- networking.firewall = {
84
- enable = true;
85
-
86
- # be a good network citizen and allow some debugging interactions
87
- rejectPackets = true;
88
- allowPing = true;
89
-
90
- # prevent firewall log spam from rotating the kernel rinbuffer
91
- logRefusedConnections = false;
92
- };
93
-
83
services.resolved = {
84
enable = true;
85
fallbackDns = [
modules/nftables.nix
new
+29
@@ -0,0 +1,29 @@
1
+{
2
+ lib,
3
+ ...
4
+}:
5
+
6
+{
7
+ networking.nftables = {
8
+ enable = true;
9
+ tables."nixos-fw".content = lib.mkBefore ''
10
+ define prometheus_inet6 = {
11
+ 2a01:4f9:3070:15e0::1
12
+ }
13
+ define prometheus_inet4 = {
14
+ 37.27.99.100
15
+ }
16
+ '';
17
+ };
18
+
19
+ networking.firewall = {
20
+ enable = true;
21
+
22
+ # be a good network citizen and allow some debugging interactions
23
+ rejectPackets = true;
24
+ allowPing = true;
25
+
26
+ # prevent firewall log spam from rotating the kernel ringbuffer
27
+ logRefusedConnections = false;
28
+ };
29
+}
non-critical-infra/modules/common.nix
+4
-2
@@ -1,6 +1,10 @@
1
{ pkgs, ... }:
2
3
{
4
+ imports = [
5
+ ../../modules/nftables.nix
6
+ ];
7
+
8
boot.initrd.systemd.enable = true;
9
10
time.timeZone = "UTC";
@@ -10,8 +14,6 @@
14
15
environment.systemPackages = with pkgs; [ neovim ];
16
13
- networking.nftables.enable = true;
14
-
17
security.acme.acceptTerms = true;
18
security.acme.defaults.email = "infra@nixos.org";
19
}