Merge branch 'master' into firewall-changes

Reviewed-on: wymiller/nix-config-v2#16

flake.lock

@@ -32,11 +32,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1790492877,
-        "narHash": "sha256-RK9eeRQv9l3pQ8qNCdJ8fpkFCp/+QpNn7lR7Kkfrv8w=",
+        "lastModified": 1791702392,
+        "narHash": "sha256-8uWZP3UiJBtYzBzazI18WvlshKYHxPb+8aqm02OxL5M=",
         "ref": "refs/heads/master",
-        "rev": "d3216bbe660f8265f1393ecf263ab5f8662f5a58",
-        "revCount": 26,
+        "rev": "ee2a27ad749d6d774e26c2be5de5f3a5ecd4a93f",
+        "revCount": 28,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/caitsith.git"
       },
@@ -267,11 +267,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1791626528,
-        "narHash": "sha256-kWT9qwTKo6igVW+PweF2yZGlnfGRAcK4gsxpC/Yv7vA=",
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "63bc96eab718f6f78c6d78f1309c3a58a8babfc6",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -290,11 +290,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790872110,
-        "narHash": "sha256-dXrMwUGE/9pT0J7MeW1BuYxpnnPPc52/oLxfqQF/5q8=",
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "8e136930a2a34c501d612f7b7b0ee8806531768f",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -313,11 +313,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1790492923,
-        "narHash": "sha256-pi8p2jRW9pprb0ZFH50/Z9Bxv0bKgddMXbLZ0D03L3w=",
+        "lastModified": 1791702441,
+        "narHash": "sha256-qHf8tVIYu6OE1PKcthmpBgblg27u3bU7v4TVqy0B3jg=",
         "ref": "refs/heads/master",
-        "rev": "580082101efc0807637529e539886ee6c5f95672",
-        "revCount": 15,
+        "rev": "2c2e99f6347e9be744a72f7df6043015989d6cd7",
+        "revCount": 17,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/hildibrand.git"
       },
@@ -333,11 +333,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790996401,
-        "narHash": "sha256-f+kOxEmOUnQazVAmGg0i8hzwgd1kX/geY+k/Dpheye8=",
+        "lastModified": 1792274446,
+        "narHash": "sha256-AM1HmBeDnB2B3dSiXuCYeu7Me+lHNpz/P39lVxGJBuQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "db7d5e2332710f5abb088f6b5de927d7f9511b35",
+        "rev": "ab3823b4b24c0c3ca984c1f3ee577fd6d667424c",
         "type": "github"
       },
       "original": {
@@ -355,11 +355,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790989254,
-        "narHash": "sha256-ZN+riaeFuE+DZ5zfqJiXlM12jLwZzeIXiNkU1YeHMXI=",
+        "lastModified": 1792098797,
+        "narHash": "sha256-u4DIIZgznEGzByxXrxWCXK19VcMtTBmi/M9gZ7Jk9bM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "acd21c5a3420a9d5fd0ed06299b10828267ef9ba",
+        "rev": "640725978b99076e18e069f6e7d2959124584f8f",
         "type": "github"
       },
       "original": {
@@ -417,11 +417,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1791426274,
-        "narHash": "sha256-MWhktfFtFE8Jl7bf9Pkp7TR5MSdYCjCswSo0Gkb4ywc=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7c8764b7c7b09b34f632464276218ef9090eaa11",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1790920529,
-        "narHash": "sha256-nQyFkMR78WP6PiXKkDW2SjqzLf/spQqjRuxRGSbcV8k=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "774debe7a0d1b496e35677ad955a1011c6ff74f3",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1791097561,
-        "narHash": "sha256-AmeVVy0WbW/y/sZv7ZGYn3dY6HuHPqvUgYorahAe4lM=",
+        "lastModified": 1792344577,
+        "narHash": "sha256-Sbd2veIdg9iDiwwDeEKIiuk8FYMtjBXWvDlrrM0FjVA=",
         "ref": "refs/heads/master",
-        "rev": "55e8c40fbcd0c848c38002fdefb37de7084715be",
-        "revCount": 107,
+        "rev": "2debafc63297a24d2ca5c749b0d3f6bdbf6324cb",
+        "revCount": 113,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/nur.git"
       },
@@ -507,11 +507,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1791651540,
-        "narHash": "sha256-cxmegj6Tg0xYk8A2icSl3v1+SeVDj+bESU2BnCqERPE=",
+        "lastModified": 1792175215,
+        "narHash": "sha256-XD64JVLV8iE4lR+W5gkTweEaT+SBwOrSy0+le2WgITI=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "19992540d372466340ededda0c065a3a0a962fd6",
+        "rev": "a736b60b1e2019931168979951c94dc46e342957",
         "type": "github"
       },
       "original": {
@@ -563,11 +563,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790407471,
-        "narHash": "sha256-M8elY2UShg4ZuLTiRLEHO+ae5xQFp3/ReQdxp/R+1UU=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4e9bb05a9ab6c37dc74c22974ebed6e36dc73eb2",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -585,11 +585,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790407471,
-        "narHash": "sha256-M8elY2UShg4ZuLTiRLEHO+ae5xQFp3/ReQdxp/R+1UU=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4e9bb05a9ab6c37dc74c22974ebed6e36dc73eb2",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -606,11 +606,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1791013993,
-        "narHash": "sha256-BiFPwFsbFnZH5GfWbQFKYuQNg+67aNQCoRSRNTeJFQc=",
+        "lastModified": 1792219666,
+        "narHash": "sha256-RMO08tKD+hFIL5ryWi85VY4aHE5oIpdV1h4kVFctOkw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "7470661ba2b51156048af08464b82020223dc942",
+        "rev": "a110337465cfb76e3806b81b9db3094c3e6e770a",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1791620365,
-        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
+        "lastModified": 1792307278,
+        "narHash": "sha256-wJgFFtw/vlzsjWrQFmTn40TTkSkqHM4XXN0nh4q4uMk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
+        "rev": "42076d1c6a0fb405ed04f9a674e4a8f69de62ba3",
         "type": "github"
       },
       "original": {

home/shell.nix

@@ -66,8 +66,14 @@
             "The gods themselves will be my meal. Your dear companions my dessert. Upon this world I'll feast, and death shall follow in my wake. All your hate, all your rage, you will render unto me." \
             "Boring, boring, boring" \
             "Would you be 'happier' had I a 'good reason'?" \
-            "A test of your reflexes!"
-
+            "A test of your reflexes!" \ 
+            "Yer a wizard, Wyatt" \
+            "Yer a lizard, Wyatt" \ 
+            "Po-Tay-To boil em mash em stick em in a stew" \ 
+            "Oh look it's the cutie patootie potato!" 
+            "What a charming young man" \ 
+            "Wyatt, you are smart, kind, and resilient. I believe in you no matter what life throws at you! Kick this project's butt!! - Nico" \
+            "Ganbatte!"
 
           set choose_meme (random)"%"(count $memes)
           set choose_meme $memes[(math $choose_meme"+1")]

modules/machine/cloud/configuration.nix

@@ -151,7 +151,10 @@ in {
 
   # Core networking module (see ../../networking/core.nix)
   network = {
-    firewall.enable = true;
+    firewall = {
+      enable = true;
+      firewalld.enable = true;
+    };
     networkManager.enable = true;
   };
 

modules/networking/core.nix

@@ -8,6 +8,12 @@ in {
   options.network = {
     firewall = {
       enable = lib.mkEnableOption "system firewall";
+      firewalld.enable = lib.mkEnableOption "firewalld with its nftables backend";
+      nftables.extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Rules inside a separate inet nftables table alongside firewalld";
+      };
       tcpPorts = {
         ssh.enable = lib.mkEnableOption "SSH service port (22)";
         web.enable = lib.mkEnableOption "common web service ports (80, 443)";
@@ -42,6 +48,21 @@ in {
     };
   };
   config = {
+    assertions = [
+      {
+        assertion = cfg.firewall.nftables.extraConfig == "" || cfg.firewall.firewalld.enable;
+        message = "network.firewall.nftables.extraConfig requires network.firewall.firewalld.enable";
+      }
+    ];
+    services.firewalld.enable = cfg.firewall.firewalld.enable;
+    networking.nftables = lib.mkIf cfg.firewall.firewalld.enable {
+      enable = true;
+      flushRuleset = false;
+      tables."local-extra" = lib.mkIf (cfg.firewall.nftables.extraConfig != "") {
+        family = "inet";
+        content = cfg.firewall.nftables.extraConfig;
+      };
+    };
     networking.firewall = {
       enable = cfg.firewall.enable;
       allowedTCPPorts = lib.flatten [