wymiller/nix-config-v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactored custom core networking

Browse Source
This commit is contained in:
Wyatt J. Miller 2025-01-04 19:27:42 -05:00
parent b5b66f1c1b
commit 1c054207b2
1 changed files with 27 additions and 102 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

129
modules/networking/core.nix
View File

@ -7,85 +7,24 @@
in { in {
options.network = { options.network = {
firewall = { firewall = {
enable = lib.mkEnableOption { enable = lib.mkEnableOption "system firewall";
type = lib.types.bool;
default = true;
description = "Enable system firewall";
};
tcpPorts = { tcpPorts = {
# Predefined, default common service ports ssh.enable = lib.mkEnableOption "SSH service port (22)";
ssh = { web.enable = lib.mkEnableOption "common web service ports (80, 443)";
enable = lib.mkEnableOption { smtp.enable = lib.mkEnableOption "SMTP service ports (25, 465, 587)";
type = lib.types.bool; imap.enable = lib.mkEnableOption "IMAP service ports (143, 993)";
default = false; mysql.enable = lib.mkEnableOption "MySQL service port (3306)";
description = "Open SSH service port (22)"; mssql.enable = lib.mkEnableOption "Microsoft SQL Server service port (1433)";
}; postgres.enable = lib.mkEnableOption "Postgres service port (5432)";
};
web = {
enable = lib.mkEnableOption {
type = lib.types.bool;
default = false;
description = "Open common web service ports (80, 443)";
};
};
smtp = {
enable = lib.mkEnableOption {
type = lib.types.bool;
default = false;
description = "Open SMTP service ports (25, 465, 587)";
};
};
imap = {
enable = lib.mkEnableOption {
type = lib.types.bool;
default = false;
description = "Open IMAP service ports (143, 993)";
};
};
mysql = {
enable = lib.mkEnableOption {
type = lib.types.bool;
default = false;
description = "Open MySQL service port (3306)";
};
};
mssql = {
enable = lib.mkEnableOption {
type = lib.types.bool;
default = false;
description = "Open Microsoft SQL Server service port (1433)";
};
};
postgres = {
enable = lib.mkEnableOption {
type = lib.types.bool;
default = false;
description = "Open Postgres service port (5432)";
};
};
allowedPorts = lib.mkOption { allowedPorts = lib.mkOption {
type = lib.types.listOf lib.types.port; type = lib.types.listOf lib.types.port;
default = []; default = [];
description = "List of custom TCP ports to open"; description = "List of custom TCP ports to open";
}; };
}; };
udpPorts = { udpPorts = {
dns = { dns.enable = lib.mkEnableOption "DNS service port (53)";
enable = lib.mkEnableOption { ntp.enable = lib.mkEnableOption "NTP service port (123)";
type = lib.types.bool;
default = false;
description = "Open DNS service port (53)";
};
};
ntp = {
enable = lib.mkEnableOption {
type = lib.types.bool;
default = false;
description = "Open NTP service port (123)";
};
};
allowedPorts = lib.mkOption { allowedPorts = lib.mkOption {
type = lib.types.listOf lib.types.port; type = lib.types.listOf lib.types.port;
default = []; default = [];
@ -93,14 +32,8 @@ in {
}; };
}; };
}; };
networkManager = { networkManager = {
enable = lib.mkEnableOption { enable = lib.mkEnableOption "NetworkManager for network connection management";
type = lib.types.bool;
default = true;
description = "Enable NetworkManager for network connection management";
};
extraPlugins = lib.mkOption { extraPlugins = lib.mkOption {
type = lib.types.listOf lib.types.package; type = lib.types.listOf lib.types.package;
default = []; default = [];
@ -108,33 +41,25 @@ in {
}; };
}; };
}; };
config = { config = {
network.firewall = { networking.firewall = {
enable = cfg.firewall.enable; enable = cfg.firewall.enable;
allowedTCPPorts = lib.flatten [
allowedTCPPorts = (lib.optionals cfg.firewall.tcpPorts.ssh.enable [22])
( (lib.optionals cfg.firewall.tcpPorts.web.enable [80 443])
lib.optionals (lib.optionals cfg.firewall.tcpPorts.smtp.enable [25 465 587])
cfg.firewall.tcpPorts.ssh.enable [22] (lib.optionals cfg.firewall.tcpPorts.imap.enable [143 993])
cfg.firewall.tcpPorts.web.enable [80 443] (lib.optionals cfg.firewall.tcpPorts.mysql.enable [3306])
cfg.firewall.tcpPorts.smtp.enable [25 465 587] (lib.optionals cfg.firewall.tcpPorts.mssql.enable [1433])
cfg.firewall.tcpPorts.imap.enable [143 993] (lib.optionals cfg.firewall.tcpPorts.postgres.enable [5432])
cfg.firewall.tcpPorts.mysql.enable [3306] cfg.firewall.tcpPorts.allowedPorts
cfg.firewall.tcpPorts.mssql.enable [1433] ];
cfg.firewall.tcpPorts.postgres.enable [5432] allowedUDPPorts = lib.flatten [
) (lib.optionals cfg.firewall.udpPorts.dns.enable [53])
++ cfg.firewall.tcpPorts.allowedPorts; (lib.optionals cfg.firewall.udpPorts.ntp.enable [123])
cfg.firewall.udpPorts.allowedPorts
allowedUDPPorts = ];
(
lib.optionals
cfg.firewall.udpPorts.dns.enable [53]
cfg.firewall.udpPorts.ntp.enable [123]
)
++ cfg.firewall.udpPorts.allowedPorts;
}; };
networking.networkmanager = { networking.networkmanager = {
enable = lib.mkForce cfg.networkManager.enable; enable = lib.mkForce cfg.networkManager.enable;
packages = cfg.networkManager.extraPlugins; packages = cfg.networkManager.extraPlugins;