nixos/prometheus: use append instead of insert for opening firewalls (#55224)
Inserting with `-I` causes the rules to placed before `ctstate` tracking, while `-A` places them alongside all other allow rules.
This commit is contained in:
parent
a09281ef5a
commit
c53703a6b2
|
@ -119,7 +119,7 @@ let
|
|||
mkExporterConf = { name, conf, serviceOpts }:
|
||||
mkIf conf.enable {
|
||||
networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
|
||||
"ip46tables -I nixos-fw ${conf.firewallFilter} "
|
||||
"ip46tables -A nixos-fw ${conf.firewallFilter} "
|
||||
"-m comment --comment ${name}-exporter -j nixos-fw-accept"
|
||||
]);
|
||||
systemd.services."prometheus-${name}-exporter" = mkMerge ([{
|
||||
|
|
Loading…
Reference in a new issue