0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00

Files

T

ryan4yin | 二花 e5b95affa6 feat(nixos): default-deny host inbound, trust the LAN/tailnet (#325 )

Hosts used to trust the router as the only boundary (servers ran with the
firewall off; service ports were opened globally), so any LAN device could
reach every host service. Move filtering to the hosts as defence in depth
behind the router, which keeps its firewall on and uses a port mapping for
the few ports we actually need.

- base: nftables backend; deny inbound by default; trust the home LAN by
  source and the tailnet by interface (restrict the tailnet with ACLs);
  suppress per-service `openFirewall` global ports; allow node_exporter only
  from the monitoring host. The local podman bridge, the tailnet and the pod
  CIDRs are accepted only after the node_exporter drop.
- servers: stop disabling the firewall; drop redundant global port opens
  (caddy 80/443, NFS 2049, Jellyfin, localsend/test ports); delete the
  redundant desktop firewall module; aarch64/riscv64 import the firewall
  explicitly (akane was missing it).
- k3s: Cilium pods (10.0.0.0/8, fd00::/8) may reach host services; drop the
  flannel-era cni0/flannel.1 trust.
- youko: postgres listens on localhost + the LAN with pg_hba limited to the
  LAN; the NFS export stays LAN-scoped; remove the unauthenticated v2ray
  proxy.
- tests: `security-firewall` asserts every host runs the shared firewall, has
  the LAN CIDR rule and no global ports.

2026-09-26 14:02:03 +08:00

attrs.nix

feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'

2025-07-30 12:17:24 +08:00

colmenaSystem.nix

refactor: rename the three VM hosts to 12kingdoms-*

2026-09-21 17:10:14 +08:00

default.nix

feat(k8s): add the k3s-test-1 worker nodes (#307 )

2026-09-21 23:09:13 +08:00

genK3sAgentModule.nix

feat(nixos): default-deny host inbound, trust the LAN/tailnet (#325 )

2026-09-26 14:02:03 +08:00

genK3sServerModule.nix

feat(nixos): default-deny host inbound, trust the LAN/tailnet (#325 )

2026-09-26 14:02:03 +08:00

genLibvirtDomainXml.nix

chore: drop the KubeVirt guest bits

2026-09-21 17:24:40 +08:00

genMicrovmGuestModule.nix

fix(k3s): drop Home Manager from test masters

2026-09-24 13:35:33 +08:00

genVmHostModule.nix

chore(hosts): retire the k3s cluster on the physical hosts

2026-09-21 16:57:42 +08:00

macosSystem.nix

feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'

2025-07-30 12:17:24 +08:00

nixosSystem.nix

chore: replace nixos-generators image outputs

2026-06-14 14:10:08 +08:00

README.md

docs: refresh stale docs after the VM and backup refactors

2026-09-21 22:03:21 +08:00

README.md

Library

This directory contains helper functions used by outputs/default.nix (and the installer flake) to reduce code duplication and make it easier to add new machines.

Current Functions

Core System Generators

attrs.nix - Attribute set manipulation utilities
macosSystem.nix - macOS configuration generator for nix-darwin
nixosSystem.nix - NixOS configuration generator
colmenaSystem.nix - Remote deployment configuration for colmena

Specialized Module Generators

genK3sServerModule.nix - K3s server node configuration generator
genVmHostModule.nix - physical VM host (bridge + libvirt) configuration generator
genMicrovmGuestModule.nix - NixOS microVM guest configuration generator
genLibvirtDomainXml.nix - libvirt domain XML generator (imported directly by host configs)

Entry Point

default.nix - Main entry point that imports the generators and exports them as a single attribute set, plus the relativeToRoot and scanPaths helpers

Usage

These functions are designed to:

Generate consistent configurations across different architectures
Provide type-safe configuration for complex systems
Enable easy scaling of the infrastructure
Support both local development and production deployments

Architecture Support

x86_64-linux: Primary desktop systems
aarch64-linux: ARM64 Linux systems (Apple Silicon, SBCs)
aarch64-darwin: Apple Silicon macOS systems