52 lines
1.2 KiB
Nix
52 lines
1.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
virtualisation.incus.enable = true;
|
|
networking = {
|
|
nftables = {
|
|
enable = true;
|
|
ruleset = ''
|
|
table inet crusader_isolation {
|
|
chain fwd_pre {
|
|
type filter hook forward priority -200; policy accept;
|
|
|
|
# Antworten auf vom LAN aufgebaute Verbindungen erlauben (Tailscale-Hairpin)
|
|
ct state established,related accept
|
|
|
|
# Crusader-Netz darf NICHT ins LAN
|
|
iifname "incusbr1" ip daddr 192.168.0.0/16 drop
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
firewall = {
|
|
trustedInterfaces = [ "incusbr2" ];
|
|
filterForward = false;
|
|
|
|
interfaces = {
|
|
incusbr1 = {
|
|
allowedTCPPorts = [ 53 ];
|
|
allowedUDPPorts = [
|
|
53
|
|
67
|
|
68
|
|
41641 # Tailscale / WireGuard
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
nat = {
|
|
enable = true;
|
|
externalInterface = "incusbr2";
|
|
internalInterfaces = [ "incusbr1" ];
|
|
internalIPs = [ "10.46.33.0/24" ];
|
|
forwardPorts = [ { sourcePort = 41642; proto = "udp"; destination = "10.46.33.216:41642"; } ]; # crusader tailscale
|
|
};
|
|
};
|
|
|
|
# Load the kernel volume for lvm thin provisioning
|
|
boot.kernelModules = [ "dm_thin_pool" "dm_snapshot" ];
|
|
}
|
|
|