Richie
e4eef6dff0
treefmt / nix fmt (pull_request) Successful in 5s
pytest / pytest (pull_request) Successful in 29s
test ebook search / test-ebook-search (pull_request) Successful in 34s
build_systems / build-brain (pull_request) Successful in 48s
build_systems / build-bob (pull_request) Successful in 48s
build_systems / build-rhapsody-in-green (pull_request) Successful in 58s
build_systems / build-jeeves (pull_request) Successful in 2m14s
- split networking into interface and firewall modules - define named service ports in one location - remove scattered service-level firewall rules
48 lines
944 B
Nix
48 lines
944 B
Nix
let
|
|
ports = {
|
|
audiobookshelf = 8000;
|
|
ebook_searcher = 8070;
|
|
gems = 8002;
|
|
gitea_http = 6443;
|
|
gitea_ssh = 2223;
|
|
grafana = 3000;
|
|
jellyfin_http = 8096;
|
|
nix_binary_cache = 5000;
|
|
nornsight = 8001;
|
|
ollama = 11434;
|
|
open_webui = 8080;
|
|
postgresql = 5432;
|
|
share = 8091;
|
|
signal_cli = 8989;
|
|
syncthing = 8384;
|
|
};
|
|
in
|
|
{
|
|
networking.firewall = {
|
|
enable = true;
|
|
interfaces.br-nix-builder = {
|
|
allowedTCPPorts = [ ];
|
|
allowedUDPPorts = [ ];
|
|
};
|
|
interfaces.tailscale0.allowedTCPPorts = [
|
|
ports.audiobookshelf
|
|
ports.gems
|
|
ports.jellyfin_http
|
|
ports.nix_binary_cache
|
|
ports.nornsight
|
|
ports.share
|
|
];
|
|
allowedTCPPorts = [
|
|
ports.ebook_searcher
|
|
ports.gitea_http
|
|
ports.gitea_ssh
|
|
ports.grafana
|
|
ports.ollama
|
|
ports.open_webui
|
|
ports.postgresql
|
|
ports.signal_cli
|
|
ports.syncthing
|
|
];
|
|
};
|
|
}
|