summaryrefslogtreecommitdiffstats
path: root/tv
diff options
context:
space:
mode:
authorlassulus <git@lassul.us>2023-06-21 16:01:33 +0200
committerlassulus <git@lassul.us>2023-06-21 16:01:33 +0200
commita0c4427c0baa94603fa10c1248944e7837e72642 (patch)
treecaa4053366d62b683e6f6e746e9df0317de88c80 /tv
parentc6593fdb393a585e631b9824e2bb3857ba2f90c6 (diff)
parentfdc364520238a38883d28bbfa05ac966e792ed8b (diff)
Merge remote-tracking branch 'ni/flakify'
Diffstat (limited to 'tv')
-rw-r--r--tv/2configs/sshd.nix17
1 files changed, 8 insertions, 9 deletions
diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix
index 0610e3c98..59c95ccba 100644
--- a/tv/2configs/sshd.nix
+++ b/tv/2configs/sshd.nix
@@ -1,6 +1,9 @@
with import ./lib;
{ config, ... }: let
cfg.host = config.krebs.build.host;
+ nets =
+ optional (cfg.host.nets?retiolum) cfg.host.nets.retiolum ++
+ optional (cfg.host.nets?wiregrill) cfg.host.nets.wiregrill;
in {
services.openssh = {
enable = true;
@@ -12,15 +15,11 @@ in {
tv.iptables.extra4.nat.PREROUTING =
map
(net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT")
- (filter (net: net.ip4 != null)
- [
- cfg.host.nets.retiolum
- cfg.host.nets.wiregrill
- ]);
- tv.iptables.extra6.nat.PREROUTING = [
- "-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT"
- "-d ${cfg.host.nets.wiregrill.ip6.addr} -p tcp --dport 22 -j ACCEPT"
- ];
+ (filter (net: net.ip4 != null) nets);
+ tv.iptables.extra6.nat.PREROUTING =
+ map
+ (net: "-d ${net.ip6.addr} -p tcp --dport 22 -j ACCEPT")
+ (filter (net: net.ip6 != null) nets);
tv.iptables.extra.nat.PREROUTING = [
"-p tcp --dport 22 -j REDIRECT --to-ports 0"
"-p tcp --dport 11423 -j REDIRECT --to-ports 22"