Mic92
/
stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tv sshd: admit missing nets

This commit is contained in:
tv 2023-06-21 14:30:17 +02:00
parent 98584f2db9
commit d59586939d
1 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
tv/2configs/sshd.nix
View File

@ -1,6 +1,9 @@
with import ./lib; with import ./lib;
{ config, ... }: let { config, ... }: let
cfg.host = config.krebs.build.host; cfg.host = config.krebs.build.host;
nets =
optional (cfg.host.nets?retiolum) cfg.host.nets.retiolum ++
optional (cfg.host.nets?wiregrill) cfg.host.nets.wiregrill;
in { in {
services.openssh = { services.openssh = {
enable = true; enable = true;
@ -12,15 +15,11 @@ in {
tv.iptables.extra4.nat.PREROUTING = tv.iptables.extra4.nat.PREROUTING =
map map
(net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT") (net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT")
(filter (net: net.ip4 != null) (filter (net: net.ip4 != null) nets);
[ tv.iptables.extra6.nat.PREROUTING =
cfg.host.nets.retiolum map
cfg.host.nets.wiregrill (net: "-d ${net.ip6.addr} -p tcp --dport 22 -j ACCEPT")
]); (filter (net: net.ip6 != null) nets);
tv.iptables.extra6.nat.PREROUTING = [
"-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT"
"-d ${cfg.host.nets.wiregrill.ip6.addr} -p tcp --dport 22 -j ACCEPT"
];
tv.iptables.extra.nat.PREROUTING = [ tv.iptables.extra.nat.PREROUTING = [
"-p tcp --dport 22 -j REDIRECT --to-ports 0" "-p tcp --dport 22 -j REDIRECT --to-ports 0"
"-p tcp --dport 11423 -j REDIRECT --to-ports 22" "-p tcp --dport 11423 -j REDIRECT --to-ports 22"