Merge branch 'master' into firewall-changes

flake.lock

@@ -9,11 +9,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1792853286,
-        "narHash": "sha256-l/Oh5k1NQqQuwh4gBF3VcmCF0WGiCT/LqfvY5huhOq4=",
+        "lastModified": 1789138122,
+        "narHash": "sha256-mh+ZiGCtHAo0xIi1yaNjHsftfnlWz9JiYwHCyT16yIE=",
         "owner": "ezKEa",
         "repo": "aagl-gtk-on-nix",
-        "rev": "e9a3b8fdb50a7d77a90c02c84e298c286310385b",
+        "rev": "d82d6d6f66caf4b63fb154e62fad83c627874127",
         "type": "github"
       },
       "original": {
@@ -52,11 +52,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1792800221,
-        "narHash": "sha256-53jIZEWNh96irEXhsMZFoNhLJgGSU3nYl1i4wFQHAsU=",
+        "lastModified": 1783744694,
+        "narHash": "sha256-2cp6N3rrwnGYLTx9l6N+NI+kwrCWxvJUbj5WJhvB29A=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "d31953cf55f9027a56e9be938daf5db8c5655663",
+        "rev": "c3e90c89649b07d1a96e4b9dd6cd0d6e44b91a74",
         "type": "github"
       },
       "original": {
@@ -267,11 +267,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1792644631,
-        "narHash": "sha256-3aILZu5bQ+6khPvGCdIbC7wBFZOgPbpP0TBSL9tf89E=",
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "ff2b494b477eb4349dd40f0564cedab552f9804d",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -333,11 +333,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1792818383,
-        "narHash": "sha256-199i7ubVSXTMl+0AAlL7cVCXSjcI+jWByMcimYjeMX0=",
+        "lastModified": 1792274446,
+        "narHash": "sha256-AM1HmBeDnB2B3dSiXuCYeu7Me+lHNpz/P39lVxGJBuQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "24f2190587513b9c2f73db112a17844ae912d965",
+        "rev": "ab3823b4b24c0c3ca984c1f3ee577fd6d667424c",
         "type": "github"
       },
       "original": {
@@ -417,11 +417,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1792615934,
-        "narHash": "sha256-MlvRfa1O5Cqc2/a+gG+l9TSuowEoCKCmrJ1d9oAVm0I=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1792639431,
-        "narHash": "sha256-ZFh9vzagl6LegBH4gjIvEWIvNuZGEqOQX0LiAwt9DA8=",
+        "lastModified": 1792344577,
+        "narHash": "sha256-Sbd2veIdg9iDiwwDeEKIiuk8FYMtjBXWvDlrrM0FjVA=",
         "ref": "refs/heads/master",
-        "rev": "ce646a959820bed061d173e7631cd13d39edd532",
-        "revCount": 118,
+        "rev": "2debafc63297a24d2ca5c749b0d3f6bdbf6324cb",
+        "revCount": 113,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/nur.git"
       },
@@ -507,11 +507,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1792889789,
-        "narHash": "sha256-xpH3z+T5NELixXRjxGJ3mx30kz63Xt2B0ZfPWl7hcUg=",
+        "lastModified": 1792175215,
+        "narHash": "sha256-XD64JVLV8iE4lR+W5gkTweEaT+SBwOrSy0+le2WgITI=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "557d2eb05a76e5939e6a75351343cae5731a71f8",
+        "rev": "a736b60b1e2019931168979951c94dc46e342957",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1792825530,
-        "narHash": "sha256-aphXA2IFNd3q48++TKmfuuvDDjkrgGdJDnDIhij9684=",
+        "lastModified": 1792307278,
+        "narHash": "sha256-wJgFFtw/vlzsjWrQFmTn40TTkSkqHM4XXN0nh4q4uMk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "5b9f1198b59bcb31c5c3250b332e7d77590e6306",
+        "rev": "42076d1c6a0fb405ed04f9a674e4a8f69de62ba3",
         "type": "github"
       },
       "original": {

home/shell.nix

@@ -70,7 +70,7 @@
             "Yer a wizard, Wyatt" \
             "Yer a lizard, Wyatt" \ 
             "Po-Tay-To boil em mash em stick em in a stew" \ 
-            "Oh look it's the cutie patootie potato!" \
+            "Oh look it's the cutie patootie potato!" 
             "What a charming young man" \ 
             "Wyatt, you are smart, kind, and resilient. I believe in you no matter what life throws at you! Kick this project's butt!! - Nico" \
             "Ganbatte!"

modules/machine/cloud/configuration.nix

@@ -151,7 +151,10 @@ in {
 
   # Core networking module (see ../../networking/core.nix)
   network = {
-    firewall.enable = true;
+    firewall = {
+      enable = true;
+      firewalld.enable = true;
+    };
     networkManager.enable = true;
   };
 

modules/networking/core.nix

@@ -8,6 +8,12 @@ in {
   options.network = {
     firewall = {
       enable = lib.mkEnableOption "system firewall";
+      firewalld.enable = lib.mkEnableOption "firewalld with its nftables backend";
+      nftables.extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Rules inside a separate inet nftables table alongside firewalld";
+      };
       tcpPorts = {
         ssh.enable = lib.mkEnableOption "SSH service port (22)";
         web.enable = lib.mkEnableOption "common web service ports (80, 443)";
@@ -42,6 +48,21 @@ in {
     };
   };
   config = {
+    assertions = [
+      {
+        assertion = cfg.firewall.nftables.extraConfig == "" || cfg.firewall.firewalld.enable;
+        message = "network.firewall.nftables.extraConfig requires network.firewall.firewalld.enable";
+      }
+    ];
+    services.firewalld.enable = cfg.firewall.firewalld.enable;
+    networking.nftables = lib.mkIf cfg.firewall.firewalld.enable {
+      enable = true;
+      flushRuleset = false;
+      tables."local-extra" = lib.mkIf (cfg.firewall.nftables.extraConfig != "") {
+        family = "inet";
+        content = cfg.firewall.nftables.extraConfig;
+      };
+    };
     networking.firewall = {
       enable = cfg.firewall.enable;
       allowedTCPPorts = lib.flatten [