peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

architect: add allowWAN option, correctly blocking WAN traffic

Browse Source
This commit is contained in:
Giulio De Pasquale 2023-11-16 13:25:43 +01:00
parent 03939c0061
commit 0da9f7ab9d
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hosts/architect/options.nix
View File

@ -96,23 +96,29 @@ in
description = "The host for the location."; description = "The host for the location.";
default = "127.0.0.1"; default = "127.0.0.1";
}; };
port = mkOption { port = mkOption {
type = types.int; type = types.int;
description = "The port number for the location."; description = "The port number for the location.";
}; };
allow = mkOption { allow = mkOption {
type = types.listOf types.str; type = types.listOf types.str;
default = [ ]; default = [ ];
description = "IP address or CIDR block to allow."; description = "IP address or CIDR block to allow.";
}; };
path = mkOption { path = mkOption {
type = types.str; type = types.str;
default = ""; default = "";
}; };
allowWAN = mkOption {
type = types.bool;
default = false;
description = "If set to false, deny all WAN traffic.";
};
deny = mkOption { deny = mkOption {
type = types.listOf types.str; type = types.listOf types.str;
default = [ ]; default = [ ];
@ -140,9 +146,9 @@ in
proxyPass = "http://${location.host}:${toString location.port}${location.path}"; proxyPass = "http://${location.host}:${toString location.port}${location.path}";
proxyWebsockets = location.proxyWebsockets; proxyWebsockets = location.proxyWebsockets;
extraConfig = '' extraConfig = ''
${optionalString location.allowLan "deny 10.0.0.1;"}
${concatMapStringsSep "\n" (denyCIDR: "deny ${denyCIDR};") location.deny}
${concatMapStringsSep "\n" (allowCIDR: "allow ${allowCIDR};") location.allow} ${concatMapStringsSep "\n" (allowCIDR: "allow ${allowCIDR};") location.allow}
${optionalString (!location.allowWAN) "deny all;"}
${concatMapStringsSep "\n" (denyCIDR: "deny ${denyCIDR};") location.deny}
${optionalString location.allowLan ''allow ${config.architect.networks."lan".net};''} ${optionalString location.allowLan ''allow ${config.architect.networks."lan".net};''}
'' + location.extraConfig; '' + location.extraConfig;
}) })