Tom Hubrecht
3c9c38fb03
All checks were successful
Build all the nodes / ap01 (push) Successful in 1m34s
Build all the nodes / geo02 (push) Successful in 2m22s
Build all the nodes / bridge01 (push) Successful in 2m27s
Build all the nodes / hypervisor01 (push) Successful in 2m29s
Build all the nodes / geo01 (push) Successful in 2m30s
Build all the nodes / netcore02 (push) Successful in 34s
Build all the nodes / hypervisor02 (push) Successful in 1m36s
Build all the nodes / compute01 (push) Successful in 3m15s
Build all the nodes / hypervisor03 (push) Successful in 1m46s
Build all the nodes / rescue01 (push) Successful in 1m56s
Build all the nodes / tower01 (push) Successful in 1m43s
Build all the nodes / storage01 (push) Successful in 2m10s
Build all the nodes / vault01 (push) Successful in 2m5s
Build the shell / build-shell (push) Successful in 43s
Run pre-commit on all files / pre-commit (push) Successful in 36s
Build all the nodes / web02 (push) Successful in 1m41s
Build all the nodes / web01 (push) Successful in 2m12s
Build all the nodes / web03 (push) Successful in 1m37s
Also disable the ai filter for nodes that don't have nginx enabled
94 lines
2.5 KiB
Nix
94 lines
2.5 KiB
Nix
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
|
|
#
|
|
# SPDX-License-Identifier: EUPL-1.2
|
|
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib)
|
|
concatStringsSep
|
|
length
|
|
optionalAttrs
|
|
replicate
|
|
splitString
|
|
;
|
|
|
|
inherit (lib.lists) map;
|
|
|
|
c4 = "(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)";
|
|
|
|
mkV4' = p: concatStringsSep "\\." (p ++ (replicate (4 - (length p)) c4));
|
|
mkV4 = s: mkV4' (splitString "." s);
|
|
|
|
nft = s: [ "nft" ] ++ [ s ];
|
|
|
|
streams' = import ./streams.nix;
|
|
in
|
|
|
|
{
|
|
# Switch to nftables
|
|
networking.nftables.enable = true;
|
|
|
|
services.reaction = {
|
|
enable = true;
|
|
|
|
extraPackages = [ pkgs.nftables ];
|
|
|
|
runAsRoot = true;
|
|
|
|
logLevel = "WARN";
|
|
|
|
settings = {
|
|
patterns = {
|
|
ip = {
|
|
regex = "(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))";
|
|
|
|
ignoreregex = map mkV4 [
|
|
"10" # Legacy wireguard
|
|
"129.199" # ENS
|
|
"100.80" # Netbird internal
|
|
];
|
|
|
|
ignore = [
|
|
"127.0.0.1"
|
|
"::1"
|
|
];
|
|
};
|
|
};
|
|
|
|
start = [
|
|
(nft ''
|
|
table inet reaction {
|
|
set ipv4bans {
|
|
type ipv4_addr
|
|
flags interval
|
|
auto-merge
|
|
}
|
|
set ipv6bans {
|
|
type ipv6_addr
|
|
flags interval
|
|
auto-merge
|
|
}
|
|
chain input {
|
|
type filter hook input priority 0
|
|
policy accept
|
|
ip saddr @ipv4bans drop
|
|
ip6 saddr @ipv6bans drop
|
|
}
|
|
}
|
|
'')
|
|
];
|
|
|
|
stop = [ (nft "delete table inet reaction") ];
|
|
|
|
streams = {
|
|
inherit (streams') ssh;
|
|
} // (optionalAttrs config.services.nginx.enable { inherit (streams') ai-crawlers; });
|
|
};
|
|
};
|
|
}
|