mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-08-27 13:33:57 +02:00
Ryan Yin
72a6e95cab
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
12 lines
276 B
Nix
12 lines
276 B
Nix
{ lib, ... }:
|
|
{
|
|
imports = [
|
|
../base
|
|
../../base
|
|
];
|
|
|
|
# Servers run on the trusted internal LAN (NAT'd; WAN protected at the router).
|
|
# Keep the firewall off here; the secure default is ON (see modules/nixos/base/ssh.nix).
|
|
networking.firewall.enable = false;
|
|
}
|