xmonad: rofi: import more environment variables

[julm/julm-nix.git] / nixos / profiles / networking / nftables.nix

diff --git a/nixos/profiles/networking/nftables.nix b/nixos/profiles/networking/nftables.nix
index 77f527d563c292abcc1b1917540ced7bcd1b329b..2f4410f70a4adc7411e8ab1c4c716637fee9d2cc 100644 (file)
--- a/nixos/profiles/networking/nftables.nix
+++ b/nixos/profiles/networking/nftables.nix
@@ -1,50 +1,12 @@
 { lib, ... }:
 {
-  /*
-    0.0.0.0/0              Default (can be advertised in BGP if desired)
-    0.0.0.0/8              Self identification
-    0.0.0.0/32             Broadcast
-    10.0.0.0/8             Private Networks (RFC 1918)
-    127.0.0.0/8            Loopback
-    128.0.0.0/16           IANA Reserved (RFC 3330)
-    172.16.0.0/12          Private Networks (RFC 1918)
-    169.254.0.0/16         Local
-    191.255.0.0/16         Reserved (RFC 3330)
-    192.0.0.0/24           IANA Reserved (RFC 3330)
-    192.0.2.0/24           Test-Net (RFC 3330)
-    192.168.0.0/16         Networks (RFC 1918)
-    198.18.0.0/15          Network Interconnect Device Benchmark Testing
-    223.255.255.0/24       Special Use Networks (RFC 3330)
-    224.0.0.0/4            Multicast
-    240.0.0.0/4            Class E Reserved
-
-
-    ::/0                   Default (can be advertised as a route in BGP to peers if desired)
-    ::/96                  IPv4-compatible IPv6 address – deprecated by RFC4291
-    ::/128                 Unspecified address
-    ::1 /128               Local host loopback address
-    ::ffff:0.0.0.0 /96     IPv4-mapped addresses
-    ::224.0.0.0 /100       Compatible address (IPv4 format)
-    ::127.0.0.0 /104       Compatible address (IPv4 format)
-    ::0.0.0.0 /104         Compatible address (IPv4 format)
-    ::255.0.0.0 /104       Compatible address (IPv4 format)
-    0000:: /8              Pool used for unspecified, loopback and embedded IPv4 addresses
-    0200:: /7              OSI NSAP-mapped prefix set (RFC4548) – deprecated by RFC4048
-    3ffe::/16              Former 6bone, now decommissioned
-    2001:db8::/32          Reserved by IANA for special purposes and documentation
-    2002:e000:: /20        Invalid 6to4 packets (IPv4 multicast)
-    2002:7f00:: /24        Invalid 6to4 packets (IPv4 loopback)
-    2002:0000:: /24        Invalid 6to4 packets (IPv4 default)
-    2002:ff00:: /24        Invalid 6to4 packets
-    2002:0a00:: /24        Invalid 6to4 packets (IPv4 private 10.0.0.0/8 network)
-    2002:ac10:: /28        Invalid 6to4 packets (IPv4 private 172.16.0.0/12 network)
-    2002:c0a8:: /32        Invalid 6to4 packets (IPv4 private 192.168.0.0/16 network)
-    fc00:: /7              Unicast Unique Local Addresses (ULA) – RFC 4193
-    fe80:: /10             Link-local Unicast
-    fec0:: /10             Site-local Unicast – deprecated by RFC 3879 (replaced by ULA)
-    ff00:: /8              Multicast
-
-    https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt
-  */
-  networking.nftables.ruleset = lib.mkBefore (lib.readFile ./nftables.txt);
+  # TODO: https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt
+  networking.nftables = {
+    preCheckRuleset = ''
+      sed -i ruleset.conf \
+        -e 's/skuid  *[^ ]*/skuid nobody/g' \
+        -e 's/skgid  *[^ ]*/skgid nogroup/g'
+    '';
+    ruleset = lib.mkBefore (lib.readFile ./nftables.txt);
+  };
 }