peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor: replace network groups with direct interface type access

Browse Source
This commit is contained in:
Giulio De Pasquale (aider) 2025-04-26 17:12:46 +01:00
parent 2c350070a3
commit a5232f522b
2 changed files with 3 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/core/network.nix
View File

@ -64,12 +64,6 @@ in
description = "Interface type identifiers for easy reference."; description = "Interface type identifiers for easy reference.";
}; };
groups = mkOption {
type = types.attrsOf types.str;
default = {};
description = "Network groups for access control (CIDR ranges).";
internal = true;
};
}; };
config = { config = {
@ -80,13 +74,6 @@ in
vpn = lib.filterAttrs (_: iface: iface.type == "vpn") cfg.interfaces; vpn = lib.filterAttrs (_: iface: iface.type == "vpn") cfg.interfaces;
}; };
# Create network groups from interfaces # We don't need the groups anymore as we're using interfacesByType directly
pepe.core.network.groups = let
lanInterfaces = lib.filterAttrs (_: iface: iface.type == "lan") cfg.interfaces;
vpnInterfaces = lib.filterAttrs (_: iface: iface.type == "vpn") cfg.interfaces;
in {
lan = lib.concatStringsSep " " (lib.mapAttrsToList (_: iface: iface.net) lanInterfaces);
vpn = lib.concatStringsSep " " (lib.mapAttrsToList (_: iface: iface.net) vpnInterfaces);
};
}; };
} }

4
modules/core/vhost.nix
View File

@ -99,8 +99,8 @@ in
recommendedProxySettings = location.recommendedProxySettings; recommendedProxySettings = location.recommendedProxySettings;
extraConfig = '' extraConfig = ''
${concatMapStringsSep "\n" (allowCIDR: "allow ${allowCIDR};") location.allow} ${concatMapStringsSep "\n" (allowCIDR: "allow ${allowCIDR};") location.allow}
${optionalString location.allowLAN ''allow ${config.pepe.core.network.groups.lan};''} ${optionalString location.allowLAN (concatMapStringsSep "\n" (name: iface: "allow ${iface.net};") config.pepe.core.network.interfacesByType.lan)}
${optionalString location.allowVPN ''allow ${config.pepe.core.network.groups.vpn};''} ${optionalString location.allowVPN (concatMapStringsSep "\n" (name: iface: "allow ${iface.net};") config.pepe.core.network.interfacesByType.vpn)}
${optionalString (!location.allowWAN) "deny all;"} ${optionalString (!location.allowWAN) "deny all;"}
'' + location.extraConfig; '' + location.extraConfig;
}) })