starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-27 21:43:57 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

security: make firewall secure-by-default, disable explicitly on servers

Browse Source 
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
This commit is contained in:
Ryan Yin
2026-08-26 18:14:43 +08:00
parent 7364d5aa1b
commit 72a6e95cab
7 changed files with 39 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nixos/base/ssh.nix
+3 -2
View File
@@ -1,7 +1,8 @@
{ lib, ... }:
{
# Or disable the firewall altogether.
networking.firewall.enable = lib.mkDefault false;
# Secure by default: firewall ON everywhere unless a host explicitly disables it
# (servers disable it in modules/nixos/server/{server,server-aarch64}.nix).
networking.firewall.enable = lib.mkDefault true;
# Enable the OpenSSH daemon.
services.openssh = {
enable = true;