c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

nixos/nix-daemon-firewall: Fix firewall checking

Browse source
This commit is contained in:
Janne Heß 2025-11-29 21:32:11 +01:00
commit 7ea17890e5
No known key found for this signature in database
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nixos/modules/services/system/nix-daemon-firewall.nix
View file

@ -9,13 +9,13 @@ in
enable = lib.mkEnableOption "firewalling for outgoing traffic of the nix daemon";
allowLoopback = lib.mkOption {
description = "Whether not not to allow traffic on the loopback interface. Traffic is still subject to protocol/port rules";
description = "Whether to allow traffic on the loopback interface. Traffic is still subject to protocol/port rules";
default = false;
example = true;
};
allowPrivateNetworks = lib.mkOption {
description = "Whether not not to allow traffic to local networks. Traffic is still subject to protocol/port rules. Note that this option may break DNS resolution when the DNS resolver is in a local network";
description = "Whether to allow traffic to local networks. Traffic is still subject to protocol/port rules. Note that this option may break DNS resolution when the DNS resolver is in a local network";
default = true;
example = false;
};
@ -137,5 +137,9 @@ in
}
}
'';
# Not supported by LKL yet so the ruleset check would fail
networking.nftables.preCheckRuleset = ''
sed -i 's/socket cgroupv2 level 2 @nix_daemon//g' ruleset.conf
'';
};
}

2
nixos/tests/nix-daemon-firewall.nix
View file

@ -56,7 +56,7 @@ let
hash = hashes.a;
};
# Generates a file but tires to resolve via DNS first
# Generates a file but tries to resolve via DNS first
resolver = pkgs.writeText "pinger.nix" ''
derivation {
name = "resolver";