Added an firewall to skyflake.

Author: makuru-org

example-server.nix

@@ -40,8 +40,7 @@
   networking.hostName = "example${toString instance}";
   users.users.root.password = "";
 
-  # TODO:? Shoulld firewall be fixed?
-  networking.firewall.enable = false;
+  networking.firewall.enable = true;
 
   networking.useDHCP = false;
   networking.useNetworkd = true;

flake.nix

@@ -40,6 +40,7 @@
             ./nixos-modules/storage/seaweedfs/db-backend/etcd/options.nix
             ./nixos-modules/storage/ceph/server.nix
             ./nixos-modules/defaults.nix
+            ./nixos-modules/firewall.nix
             ./nixos-modules/nodes.nix
             ./nixos-modules/nomad.nix
             ./nixos-modules/users.nix

nixos-modules/firewall.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  networking.nftables = {
+    enable = true;
+    flushRuleset = true;
+  };
+}

nixos-modules/nomad.nix

@@ -9,6 +9,15 @@ in
       default = "sky0";
     };
 
+    # https://developer.hashicorp.com/nomad/docs/install/production/requirements#ports-used
+    networking.firewall.allowedUDPPorts = [
+      4648 #Serf WAN
+    ];
+    networking.firewall.allowedTCPPorts = [
+      4646 # HTTP API
+      4648 # Serf WAN
+    ];
+
     server.enable = mkOption {
       type = types.bool;
       default = builtins.elem config.networking.hostName cfg.servers;

nixos-modules/storage/ceph/ssh-deploy.nix

@@ -150,7 +150,10 @@ in {
       skyflake-gcroots.mountPoint = "/nix/var/nix/gcroots/skyflake";
     };
 
-    services.openssh.enable = true;
+    services.openssh = {
+      enable = true;
+      openFirewall = true;
+    };
 
     users.users = builtins.mapAttrs (_: userConfig: {
       openssh.authorizedKeys.keys = map (sshKey:

nixos-modules/storage/seaweedfs/db-backend/etcd/default.nix

@@ -17,17 +17,20 @@
           mode = "0700";
         };
 
+        networking.firewall.allowedTCPPorts = [ 2380 ];
+
         systemd.services."etcd" = {
           description = "etcd key-value store";
           wantedBy = [ "multi-user.target" ];
           after = [
             "network-online.target"
             "network.target"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
-          wants = [ "network-online.target" ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
-
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
+          wants =
+            [ "network-online.target" ]
+            ++ lib.mkIf config.networking.firewall.enable [
+              "firewall.service"
+            ];
           environment =
             # (nixpgs.filterAttrs (n: v: v != null)
             let

nixos-modules/storage/seaweedfs/options.nix

@@ -32,7 +32,7 @@
       #  '';
       #};
     };
-    S3 = lib.mkOption {
+    s3 = lib.mkOption {
       type = lib.types {
         enable = lib.mkOption {
           type = lib.bool;

nixos-modules/storage/seaweedfs/server.nix

@@ -7,6 +7,22 @@
 {
   config = lib.mkIf config.skyflake.storage.seaweedfs.enable {
 
+    networking.firewall = {
+      allowedTCPPorts =
+        [
+          9333 # seaweedfs Master
+          19333 # seaweedfs Master
+          # TODO Make option to block web UI
+          8080 # seaweedfs Volume
+          18080 # seaweedfs Volume
+          8888 # seaweedfs Filer
+          18888 # seaweedfs Filer
+        ]
+        ++ lib.mkIf config.skyflake.storage.seaweedfs.s3.enable [
+          config.skyflake.storage.seaweedfs.s3.port
+        ];
+    };
+
     users.users.seaweedfs = {
       isSystemUser = true;
       group = "seaweedfs";
@@ -38,13 +54,11 @@
           after = [
             "network-online.target"
             "etcd.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           wants = [
             "network-online.target"
             "etcd.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           unitConfig = {
             Documentation = "https://github.com/seaweedfs/seaweedfs/wiki";
           };
@@ -73,14 +87,12 @@
             "network-online.target"
             "etcd.service"
             "seaweedfs-master.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           wants = [
             "network-online.target"
             "etcd.service"
             "seaweedfs-master.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           unitConfig = {
             Documentation = "https://github.com/seaweedfs/seaweedfs/wiki";
           };
@@ -106,14 +118,12 @@
             "network-online.target"
             "etcd.service"
             "seaweedfs-master.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           wants = [
             "network-online.target"
             "etcd.service"
             "seaweedfs-master.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           unitConfig = {
             Documentation = "https://github.com/seaweedfs/seaweedfs/wiki";
           };
@@ -143,14 +153,12 @@
             "network-online.target"
             "etcd.service"
             "seaweedfs-filer.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           wants = [
             "network-online.target"
             "etcd.service"
             "seaweedfs-filer.service"
-          ];
-          #  ++ lib.optional config.networking.firewall.enable "firewall.service";
+          ] ++ lib.mkIf config.networking.firewall.enable [ "firewall.service" ];
           unitConfig = {
             Documentation = "https://github.com/seaweedfs/seaweedfs/wiki";
           };

nixos-modules/storage/seaweedfs/ssh-deploy.nix

@@ -150,7 +150,10 @@ in {
       ${config.skyflake.deploy.sharedGcrootsPath}.mountSource = "/skyflake-internals${config.skyflake.deploy.sharedGcrootsPath}";
     };
 
-    services.openssh.enable = true;
+    services.openssh = {
+      enable = true;
+      openFirewall = true;
+    };
 
     users.users = builtins.mapAttrs (_: userConfig: {
       openssh.authorizedKeys.keys = map (sshKey: