From 7ea17890e59684c4be74041e7166687e5ee0d04d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Sat, 29 Nov 2025 21:32:11 +0100
Subject: [PATCH] nixos/nix-daemon-firewall: Fix firewall checking

---
 nixos/modules/services/system/nix-daemon-firewall.nix | 8 ++++++--
 nixos/tests/nix-daemon-firewall.nix                   | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/system/nix-daemon-firewall.nix b/nixos/modules/services/system/nix-daemon-firewall.nix
index 1d738ae27f9c..9c3945d3c9ef 100644
--- a/nixos/modules/services/system/nix-daemon-firewall.nix
+++ b/nixos/modules/services/system/nix-daemon-firewall.nix
@@ -9,13 +9,13 @@ in
     enable = lib.mkEnableOption "firewalling for outgoing traffic of the nix daemon";
 
     allowLoopback = lib.mkOption {
-      description = "Whether not not to allow traffic on the loopback interface. Traffic is still subject to protocol/port rules";
+      description = "Whether to allow traffic on the loopback interface. Traffic is still subject to protocol/port rules";
       default = false;
       example = true;
     };
 
     allowPrivateNetworks = lib.mkOption {
-      description = "Whether not not to allow traffic to local networks. Traffic is still subject to protocol/port rules. Note that this option may break DNS resolution when the DNS resolver is in a local network";
+      description = "Whether to allow traffic to local networks. Traffic is still subject to protocol/port rules. Note that this option may break DNS resolution when the DNS resolver is in a local network";
       default = true;
       example = false;
     };
@@ -137,5 +137,9 @@ in
         }
       }
     '';
+    # Not supported by LKL yet so the ruleset check would fail
+    networking.nftables.preCheckRuleset = ''
+      sed -i 's/socket cgroupv2 level 2 @nix_daemon//g' ruleset.conf
+    '';
   };
 }
diff --git a/nixos/tests/nix-daemon-firewall.nix b/nixos/tests/nix-daemon-firewall.nix
index 787ef54a344c..0b75b9659589 100644
--- a/nixos/tests/nix-daemon-firewall.nix
+++ b/nixos/tests/nix-daemon-firewall.nix
@@ -56,7 +56,7 @@ let
     hash = hashes.a;
   };
 
-  # Generates a file but tires to resolve via DNS first
+  # Generates a file but tries to resolve via DNS first
   resolver = pkgs.writeText "pinger.nix" ''
     derivation {
       name = "resolver";