starred/nix-config-ryan4yin
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:36 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(nfs,libvirt): restrict the golden export and bind VNC to loopback (#400)

Browse Source 
* fix(nfs): restrict the golden export to its real clients

* fix(libvirt): bind VNC consoles to loopback

* fix(firewall): drop VNC ports on every host

* docs(security): record the NFS and VNC boundaries
This commit is contained in:
ryan4yin | 二花 authored and GitHub committed 2026-10-07 15:10:52 +08:00
1 parent 43f39e8e9f
commit 3acb5d4ee5
6 files changed
+50 -20
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/security-exporters.nix
+7 -1
View File
@@ -35,7 +35,7 @@ pkgs.testers.runNixOSTest {
networking.firewall.extraInputRules = lib.mkAfter ''
ip6 saddr fd42:1::/64 accept
'';
systemd.services = lib.genAttrs [ "9100" "9633" "9835" "8080" ] (port: {
systemd.services = lib.genAttrs [ "9100" "9633" "9835" "8080" "5902" ] (port: {
wantedBy = [ "multi-user.target" ];
serviceConfig.ExecStart = "${pkgs.socat}/bin/socat TCP6-LISTEN:${port},ipv6only=0,reuseaddr,fork EXEC:${pkgs.coreutils}/bin/cat";
});
@@ -59,5 +59,11 @@ pkgs.testers.runNixOSTest {
server.succeed(f"nc -6 -z -w 3 ::1 {port}")
client.succeed("nc -z -w 3 192.168.5.200 8080")
client.succeed("nc -6 -z -w 3 fd42:1::200 8080")
# VNC is never reachable off-host on either family; loopback still works.
monitor.fail("nc -z -w 3 192.168.5.200 5902")
client.fail("nc -z -w 3 192.168.5.200 5902")
monitor.fail("nc -6 -z -w 3 fd42:1::200 5902")
client.fail("nc -6 -z -w 3 fd42:1::200 5902")
server.succeed("nc -z -w 3 127.0.0.1 5902")
'';
}