hosts: add convenient switch script

[sourcephile-nix.git] / hosts / losurdo / networking / nsupdate.nix

diff --git a/hosts/losurdo/networking/nsupdate.nix b/hosts/losurdo/networking/nsupdate.nix
index 9c69f1e2209294cd49bb6b37748948096f8cfc6c..5b34f4df0216e108fae5b8aff7973a0475a00730 100644 (file)
--- a/hosts/losurdo/networking/nsupdate.nix
+++ b/hosts/losurdo/networking/nsupdate.nix
@@ -5,6 +5,7 @@ let
   inherit (config.networking) domain;
 in
 {
+# TODO: nsupdate in the initrd
 systemd.services.nsupdate = {
   after = [
     "network-online.target"
@@ -43,9 +44,42 @@ systemd.services.nsupdate = {
     User = users."nsupdate".name;
   };
 };
-users.users."nsupdate".isSystemUser = true;
+users.users."nsupdate" = {
+  isSystemUser = true;
+  group = groups."nsupdate".name;
+};
+users.groups."nsupdate" = {};
 users.groups."keys".members = [users."nsupdate".name];
 security.gnupg.secrets."knot/tsig/${domain}/bureau1.key" = {
   user = users."nsupdate".name;
 };
+networking.nftables.ruleset =
+  lib.optionalString (config.services.upnpc.redirections != []) ''
+  # Create a rule for accepting any SSDP packets going to a remembered port.
+  add rule inet filter net2fw udp dport @ssdp_out \
+    counter accept comment "SSDP answer"
+  add rule inet filter fw2net \
+    skuid {${users.upnpc.name},${users.nsupdate.name}} \
+    tcp dport 1900 \
+    counter accept \
+    comment "SSDP automatic opening"
+  add rule inet filter fw2net \
+    skuid {${users.upnpc.name},${users.nsupdate.name}} \
+    ip daddr 239.255.255.250 udp dport 1900 \
+    set add udp sport @ssdp_out \
+    comment "SSDP automatic opening"
+  add rule inet filter fw2net \
+    skuid {${users.upnpc.name},${users.nsupdate.name}} \
+    ip daddr 239.255.255.250 udp dport 1900 \
+    counter accept comment "SSDP"
+  '' + lib.optionalString config.networking.enableIPv6 ''
+  add rule inet filter fw2net \
+    skuid {${users.upnpc.name},${users.nsupdate.name}} \
+    ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
+    set add udp sport @ssdp_out comment "SSDP automatic opening"
+  add rule inet filter fw2net \
+    skuid {${users.upnpc.name},${users.nsupdate.name}} \
+    ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
+    counter accept comment "SSDP"
+  '';
 }