Merge branch 'master' into firewall-changes

Reviewed-on: #16

flake.lock

@@ -32,11 +32,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1789888081,
-        "narHash": "sha256-GHz8B3/syibtGpMv344Qe61CRo2lZ7iN2V2hoT7MNRA=",
+        "lastModified": 1791702392,
+        "narHash": "sha256-8uWZP3UiJBtYzBzazI18WvlshKYHxPb+8aqm02OxL5M=",
         "ref": "refs/heads/master",
-        "rev": "d5a38bbc14a79967e3535c3e0951f53d9bf01800",
-        "revCount": 25,
+        "rev": "ee2a27ad749d6d774e26c2be5de5f3a5ecd4a93f",
+        "revCount": 28,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/caitsith.git"
       },
@@ -267,11 +267,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1790312761,
-        "narHash": "sha256-Ie5wLHV8N17r8EALzfAsY1Bec6M7gIl+v+FbBmazpkQ=",
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "602e108a3c17113c7a19983ff8c9b88a4ab935b6",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -290,11 +290,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790312761,
-        "narHash": "sha256-Ie5wLHV8N17r8EALzfAsY1Bec6M7gIl+v+FbBmazpkQ=",
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "602e108a3c17113c7a19983ff8c9b88a4ab935b6",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -313,11 +313,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1789887932,
-        "narHash": "sha256-ryX9MgESeWwjpFMgxlaF97FgtaRyfIELgFLEeUR8xLQ=",
+        "lastModified": 1791702441,
+        "narHash": "sha256-qHf8tVIYu6OE1PKcthmpBgblg27u3bU7v4TVqy0B3jg=",
         "ref": "refs/heads/master",
-        "rev": "70288a728cc39eb5f390f71ae24d4a58763216b1",
-        "revCount": 14,
+        "rev": "2c2e99f6347e9be744a72f7df6043015989d6cd7",
+        "revCount": 17,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/hildibrand.git"
       },
@@ -333,11 +333,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790215976,
-        "narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=",
+        "lastModified": 1792274446,
+        "narHash": "sha256-AM1HmBeDnB2B3dSiXuCYeu7Me+lHNpz/P39lVxGJBuQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a6631107a83ceab5872f298a2ea710859c80c4cb",
+        "rev": "ab3823b4b24c0c3ca984c1f3ee577fd6d667424c",
         "type": "github"
       },
       "original": {
@@ -355,11 +355,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790365885,
-        "narHash": "sha256-iQ0ebhiVo64NktTnwft9hNxlFu4j5cvljVxyJaEVIP4=",
+        "lastModified": 1792098797,
+        "narHash": "sha256-u4DIIZgznEGzByxXrxWCXK19VcMtTBmi/M9gZ7Jk9bM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b",
+        "rev": "640725978b99076e18e069f6e7d2959124584f8f",
         "type": "github"
       },
       "original": {
@@ -417,11 +417,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1790450978,
-        "narHash": "sha256-/eLCD/X9kaWJqPR47+fDozEC87Hjmm3i8gJbYmDAD7g=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5e2305d577ca00acbba631b05cb1094d172b29f3",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1790450978,
-        "narHash": "sha256-/eLCD/X9kaWJqPR47+fDozEC87Hjmm3i8gJbYmDAD7g=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e2305d577ca00acbba631b05cb1094d172b29f3",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1790492743,
-        "narHash": "sha256-z9zSi95pcqk2zmjq5XKw2kSAAiCLcAM3hxH8EukGKTw=",
+        "lastModified": 1792344577,
+        "narHash": "sha256-Sbd2veIdg9iDiwwDeEKIiuk8FYMtjBXWvDlrrM0FjVA=",
         "ref": "refs/heads/master",
-        "rev": "b1f009b0b557c4178600bc18fd495f0a8d54c35e",
-        "revCount": 103,
+        "rev": "2debafc63297a24d2ca5c749b0d3f6bdbf6324cb",
+        "revCount": 113,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/nur.git"
       },
@@ -507,11 +507,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1790221470,
-        "narHash": "sha256-TzyWd4i7YCpqoF9xB8mfgDJ2sviAZysKH9R8YbQGjqA=",
+        "lastModified": 1792175215,
+        "narHash": "sha256-XD64JVLV8iE4lR+W5gkTweEaT+SBwOrSy0+le2WgITI=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "95afe7a794216f53e217c5148c6fbe0b668192cf",
+        "rev": "a736b60b1e2019931168979951c94dc46e342957",
         "type": "github"
       },
       "original": {
@@ -563,11 +563,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789802016,
-        "narHash": "sha256-QVFfArbYaQMGK4dFV+5RUL72Ci+hNHVhaF/R9qJfDhs=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "26a71e661c47bd21a05d06fec749f3f7c75e9d12",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -585,11 +585,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789802016,
-        "narHash": "sha256-QVFfArbYaQMGK4dFV+5RUL72Ci+hNHVhaF/R9qJfDhs=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "26a71e661c47bd21a05d06fec749f3f7c75e9d12",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -606,11 +606,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790407471,
-        "narHash": "sha256-M8elY2UShg4ZuLTiRLEHO+ae5xQFp3/ReQdxp/R+1UU=",
+        "lastModified": 1792219666,
+        "narHash": "sha256-RMO08tKD+hFIL5ryWi85VY4aHE5oIpdV1h4kVFctOkw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4e9bb05a9ab6c37dc74c22974ebed6e36dc73eb2",
+        "rev": "a110337465cfb76e3806b81b9db3094c3e6e770a",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1790407471,
-        "narHash": "sha256-M8elY2UShg4ZuLTiRLEHO+ae5xQFp3/ReQdxp/R+1UU=",
+        "lastModified": 1792307278,
+        "narHash": "sha256-wJgFFtw/vlzsjWrQFmTn40TTkSkqHM4XXN0nh4q4uMk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4e9bb05a9ab6c37dc74c22974ebed6e36dc73eb2",
+        "rev": "42076d1c6a0fb405ed04f9a674e4a8f69de62ba3",
         "type": "github"
       },
       "original": {

home/neovim.nix

@@ -27,6 +27,7 @@
             enable = true;
             lsp.servers = [ "typescript-language-server" "deno" ];
           };
+          csharp.enable = true;
         };
 
         utility.surround.enable = true;

home/shell.nix

@@ -66,8 +66,14 @@
             "The gods themselves will be my meal. Your dear companions my dessert. Upon this world I'll feast, and death shall follow in my wake. All your hate, all your rage, you will render unto me." \
             "Boring, boring, boring" \
             "Would you be 'happier' had I a 'good reason'?" \
-            "A test of your reflexes!"
-
+            "A test of your reflexes!" \ 
+            "Yer a wizard, Wyatt" \
+            "Yer a lizard, Wyatt" \ 
+            "Po-Tay-To boil em mash em stick em in a stew" \ 
+            "Oh look it's the cutie patootie potato!" 
+            "What a charming young man" \ 
+            "Wyatt, you are smart, kind, and resilient. I believe in you no matter what life throws at you! Kick this project's butt!! - Nico" \
+            "Ganbatte!"
 
           set choose_meme (random)"%"(count $memes)
           set choose_meme $memes[(math $choose_meme"+1")]

modules/machine/cloud/configuration.nix

@@ -151,7 +151,10 @@ in {
 
   # Core networking module (see ../../networking/core.nix)
   network = {
-    firewall.enable = true;
+    firewall = {
+      enable = true;
+      firewalld.enable = true;
+    };
     networkManager.enable = true;
   };
 

modules/networking/core.nix

@@ -8,6 +8,12 @@ in {
   options.network = {
     firewall = {
       enable = lib.mkEnableOption "system firewall";
+      firewalld.enable = lib.mkEnableOption "firewalld with its nftables backend";
+      nftables.extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Rules inside a separate inet nftables table alongside firewalld";
+      };
       tcpPorts = {
         ssh.enable = lib.mkEnableOption "SSH service port (22)";
         web.enable = lib.mkEnableOption "common web service ports (80, 443)";
@@ -42,6 +48,21 @@ in {
     };
   };
   config = {
+    assertions = [
+      {
+        assertion = cfg.firewall.nftables.extraConfig == "" || cfg.firewall.firewalld.enable;
+        message = "network.firewall.nftables.extraConfig requires network.firewall.firewalld.enable";
+      }
+    ];
+    services.firewalld.enable = cfg.firewall.firewalld.enable;
+    networking.nftables = lib.mkIf cfg.firewall.firewalld.enable {
+      enable = true;
+      flushRuleset = false;
+      tables."local-extra" = lib.mkIf (cfg.firewall.nftables.extraConfig != "") {
+        family = "inet";
+        content = cfg.firewall.nftables.extraConfig;
+      };
+    };
     networking.firewall = {
       enable = cfg.firewall.enable;
       allowedTCPPorts = lib.flatten [