steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

workaround elctron issues, fix firewall for syncthing, set uphostkey0 as builder to steveej-t14

Browse source
This commit is contained in:
steveej 2023-12-17 23:25:24 +01:00
parent 70280c38f0
commit fd6077c476
8 changed files with 78 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

57
nix/os/devices/steveej-t14/system.nix
View file

@ -7,6 +7,23 @@
...
}: let
passwords = import ../../../variables/passwords.crypt.nix;
localTcpPorts = [
22
# syncthing
22000
# iperf3
5201
];
localUdpPorts = [
# syncthing
22000
21027
];
in {
imports = [
../../snippets/nix-settings-holo-chain.nix
@ -19,6 +36,20 @@ in {
];
};
nix.distributedBuilds = true;
nix.buildMachines = [
{
hostName = repoFlake.colmena.sj-bm-hostkey0.deployment.targetHost;
# TODO: make this a reference
sshUser = "nix-remote-builder";
protocol = "ssh-ng";
system = "x86_64-linux";
maxJobs = 24;
speedFactor = 100;
supportedFeatures = repoFlake.nixosConfigurations.router0-dmz0.config.nix.settings.system-features ++ [];
}
];
networking.extraHosts = ''
'';
@ -37,28 +68,10 @@ in {
services.openssh.openFirewall = false;
# TODO: upstream feature for inverse rule to work: `! --in-interface zt+`
networking.firewall.interfaces."eth+".allowedTCPPorts = [
22
# syncthing
22000
# iperf3
5201
# used on holochain hackathon for cache reverse proxy
80
];
networking.firewall.interfaces."eth+".allowedUDPPorts = [
# syncthing
22000
21027
];
networking.firewall.interfaces."wlan+".allowedTCPPorts = [
# used on holochain hackathon for cache reverse proxy
80
];
networking.firewall.interfaces."eth+".allowedTCPPorts = localTcpPorts;
networking.firewall.interfaces."eth+".allowedUDPPorts = localUdpPorts;
networking.firewall.interfaces."wlan+".allowedTCPPorts = localTcpPorts;
networking.firewall.interfaces."wlan+".allowedUDPPorts = localUdpPorts;
networking.firewall.logRefusedConnections = false;
networking.usePredictableInterfaceNames = false;