nixos/modules/services/networking/shorewall.nix

   1 { config, lib, pkgs, ... }:
   2 let
   3   types = lib.types;
   4   cfg = config.services.shorewall;
   5 in {
   6   options = {
   7     services.shorewall = {
   8       enable = lib.mkOption {
   9         type        = types.bool;
  10         default     = false;
  11         description = ''
  12           Whether to enable Shorewall IPv4 Firewall.
  13           <warning>
  14             <para>
  15             Enabling this service WILL disable the existing NixOS
  16             firewall! Default firewall rules provided by packages are not
  17             considered at the moment.
  18             </para>
  19           </warning>
  20         '';
  21       };
  22       package = lib.mkOption {
  23         type        = types.package;
  24         default     = pkgs.shorewall;
  25         defaultText = "pkgs.shorewall";
  26         description = "The shorewall package to use.";
  27       };
  28       configs = lib.mkOption {
  29         type        = types.attrsOf types.str;
  30         default     = {};
  31         description = ''
  32           This option defines the Shorewall configs.
  33           The attribute name defines the name of the config,
  34           and the attribute value defines the content of the config.
  35         '';
  36         apply = lib.mapAttrs (name: text: pkgs.writeText "${name}" text);
  37       };
  38     };
  39   };
  40
  41   config = lib.mkIf cfg.enable {
  42     systemd.services.firewall.enable = false;
  43     systemd.services.shorewall = {
  44       description     = "Shorewall IPv4 Firewall";
  45       after           = [ "ipset.target" ];
  46       before          = [ "network-pre.target" ];
  47       wants           = [ "network-pre.target" ];
  48       wantedBy        = [ "multi-user.target" ];
  49       reloadIfChanged = true;
  50       restartTriggers = lib.attrValues cfg.configs;
  51       serviceConfig = {
  52         Type            = "oneshot";
  53         RemainAfterExit = "yes";
  54         ExecStart       = "${cfg.package}/bin/shorewall start";
  55         ExecReload      = "${cfg.package}/bin/shorewall reload";
  56         ExecStop        = "${cfg.package}/bin/shorewall stop";
  57       };
  58       preStart = ''
  59         install -D -d -m 750 /var/lib/shorewall
  60         install -D -d -m 755 /var/lock/subsys
  61         touch                /var/log/shorewall.log
  62         chown 750            /var/log/shorewall.log
  63       '';
  64     };
  65     environment = {
  66       etc = lib.mapAttrsToList
  67               (name: file:
  68                 { source = file;
  69                   target = "shorewall/${name}";
  70                 })
  71               cfg.configs;
  72       systemPackages = [ cfg.package ];
  73     };
  74   };
  75 }