From 72a6e95cab313cd3109e2507f9a572d82d059e64 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Tue, 25 Aug 2026 21:27:15 +0800
Subject: [PATCH] security: make firewall secure-by-default, disable explicitly
 on servers

Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
---
 modules/nixos/base/ssh.nix                                 | 5 +++--
 modules/nixos/server/server-aarch64.nix                    | 4 ++++
 modules/nixos/server/server.nix                            | 4 ++++
 outputs/aarch64-linux/tests/security-firewall/expected.nix | 7 +++++++
 outputs/aarch64-linux/tests/security-firewall/expr.nix     | 7 +++++++
 outputs/x86_64-linux/tests/security-firewall/expected.nix  | 7 +++++++
 outputs/x86_64-linux/tests/security-firewall/expr.nix      | 7 +++++++
 7 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 outputs/aarch64-linux/tests/security-firewall/expected.nix
 create mode 100644 outputs/aarch64-linux/tests/security-firewall/expr.nix
 create mode 100644 outputs/x86_64-linux/tests/security-firewall/expected.nix
 create mode 100644 outputs/x86_64-linux/tests/security-firewall/expr.nix

diff --git a/modules/nixos/base/ssh.nix b/modules/nixos/base/ssh.nix
index 1409e303..e32ec737 100644
--- a/modules/nixos/base/ssh.nix
+++ b/modules/nixos/base/ssh.nix
@@ -1,7 +1,8 @@
 { lib, ... }:
 {
-  # Or disable the firewall altogether.
-  networking.firewall.enable = lib.mkDefault false;
+  # Secure by default: firewall ON everywhere unless a host explicitly disables it
+  # (servers disable it in modules/nixos/server/{server,server-aarch64}.nix).
+  networking.firewall.enable = lib.mkDefault true;
   # Enable the OpenSSH daemon.
   services.openssh = {
     enable = true;
diff --git a/modules/nixos/server/server-aarch64.nix b/modules/nixos/server/server-aarch64.nix
index d321cbc5..ce56dc4a 100644
--- a/modules/nixos/server/server-aarch64.nix
+++ b/modules/nixos/server/server-aarch64.nix
@@ -17,6 +17,10 @@
     ../../base
   ];
 
+  # Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).
+  # Keep the firewall off here; the secure default is ON (see modules/nixos/base/ssh.nix).
+  networking.firewall.enable = false;
+
   # Fix: jasper is marked as broken, refusing to evaluate.
   environment.enableAllTerminfo = lib.mkForce false;
 }
diff --git a/modules/nixos/server/server.nix b/modules/nixos/server/server.nix
index f95f803a..3e95d887 100644
--- a/modules/nixos/server/server.nix
+++ b/modules/nixos/server/server.nix
@@ -4,4 +4,8 @@
     ../base
     ../../base
   ];
+
+  # Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).
+  # Keep the firewall off here; the secure default is ON (see modules/nixos/base/ssh.nix).
+  networking.firewall.enable = false;
 }
diff --git a/outputs/aarch64-linux/tests/security-firewall/expected.nix b/outputs/aarch64-linux/tests/security-firewall/expected.nix
new file mode 100644
index 00000000..bf428c90
--- /dev/null
+++ b/outputs/aarch64-linux/tests/security-firewall/expected.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = name == "ai-niri" || name == "shoukei-niri";
+}) nixosConfigurations
diff --git a/outputs/aarch64-linux/tests/security-firewall/expr.nix b/outputs/aarch64-linux/tests/security-firewall/expr.nix
new file mode 100644
index 00000000..8423c4e8
--- /dev/null
+++ b/outputs/aarch64-linux/tests/security-firewall/expr.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = nixosConfigurations.${name}.config.networking.firewall.enable;
+}) nixosConfigurations
diff --git a/outputs/x86_64-linux/tests/security-firewall/expected.nix b/outputs/x86_64-linux/tests/security-firewall/expected.nix
new file mode 100644
index 00000000..bf428c90
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-firewall/expected.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = name == "ai-niri" || name == "shoukei-niri";
+}) nixosConfigurations
diff --git a/outputs/x86_64-linux/tests/security-firewall/expr.nix b/outputs/x86_64-linux/tests/security-firewall/expr.nix
new file mode 100644
index 00000000..8423c4e8
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-firewall/expr.nix
@@ -0,0 +1,7 @@
+{ outputs, ... }:
+let
+  inherit (outputs) nixosConfigurations;
+in
+builtins.mapAttrs (name: {
+  enabled = nixosConfigurations.${name}.config.networking.firewall.enable;
+}) nixosConfigurations