* Add an option to enable the firewall. It should eventually be
enabled by default. svn path=/nixos/branches/modular-nixos/; revision=16464
This commit is contained in:
parent
264b49fce7
commit
f0f5434eaa
|
@ -53,6 +53,7 @@
|
|||
./services/networking/dhclient.nix
|
||||
./services/networking/dhcpd.nix
|
||||
./services/networking/ejabberd.nix
|
||||
./services/networking/firewall.nix
|
||||
./services/networking/gnunet.nix
|
||||
./services/networking/gw6c.nix
|
||||
./services/networking/ifplugd.nix
|
||||
|
@ -81,9 +82,9 @@
|
|||
./services/x11/xserver/default.nix
|
||||
./services/x11/xserver/desktop-managers/default.nix
|
||||
./services/x11/xserver/desktop-managers/gnome.nix
|
||||
./services/x11/xserver/desktop-managers/kde4.nix
|
||||
./services/x11/xserver/desktop-managers/kde-environment.nix
|
||||
./services/x11/xserver/desktop-managers/kde.nix
|
||||
./services/x11/xserver/desktop-managers/kde4.nix
|
||||
./services/x11/xserver/desktop-managers/none.nix
|
||||
./services/x11/xserver/desktop-managers/xterm.nix
|
||||
./services/x11/xserver/display-managers/default.nix
|
||||
|
|
|
@ -12,6 +12,14 @@ in
|
|||
|
||||
options = {
|
||||
|
||||
networking.firewall.enable = pkgs.lib.mkOption {
|
||||
default = false;
|
||||
description =
|
||||
''
|
||||
Whether to enable the firewall.
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = pkgs.lib.mkOption {
|
||||
default = [];
|
||||
example = [22 80];
|
||||
|
@ -28,13 +36,20 @@ in
|
|||
|
||||
###### implementation
|
||||
|
||||
config = {
|
||||
# !!! Maybe if `enable' is false, the firewall should still be built
|
||||
# but not started by default. However, currently nixos-rebuild
|
||||
# doesn't deal with such Upstart jobs properly (it starts them if
|
||||
# they are changed, regardless of whether the start condition
|
||||
# holds).
|
||||
config = pkgs.lib.mkIf config.networking.firewall.enable {
|
||||
|
||||
environment.systemPackages = [pkgs.iptables];
|
||||
|
||||
jobs = pkgs.lib.singleton
|
||||
{ name = "firewall";
|
||||
|
||||
startOn = "network-interfaces/started";
|
||||
|
||||
preStart =
|
||||
''
|
||||
${iptables} -F
|
||||
|
@ -63,8 +78,6 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [22];
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
@ -131,9 +131,7 @@ in
|
|||
exec = "${openssh}/sbin/sshd -D -h /etc/ssh/ssh_host_dsa_key -f ${sshdConfig}";
|
||||
};
|
||||
|
||||
# !!! This barfs because of the mkIf ("value is a list while an
|
||||
#attribute set was expected") :-(
|
||||
#networking.firewall.allowedTCPPorts = [22];
|
||||
networking.firewall.allowedTCPPorts = [22];
|
||||
|
||||
};
|
||||
|
||||
|
|
Loading…
Reference in a new issue