3
0
Fork 0
forked from mirrors/nixpkgs

nixos/taskserver: do not open firewall port implicitly

This adds an option `services.taskserver.openFirewall` to allow the user
to choose whether or not the firewall port should be opened for the
service. This is no longer the case by default.

See also https://github.com/NixOS/nixpkgs/issues/19504.
This commit is contained in:
pacien 2022-02-11 02:30:44 +01:00
parent 9013352e3f
commit 0091e3198a
4 changed files with 22 additions and 5 deletions

View file

@ -486,6 +486,14 @@
<literal>admin</literal> and <literal>password</literal>.
</para>
</listitem>
<listitem>
<para>
The <literal>taskserver</literal> module no longer implicitly
opens ports in the firewall configuration. This is now
controlled through the option
<literal>services.taskserver.openFirewall</literal>.
</para>
</listitem>
<listitem>
<para>
The <literal>autorestic</literal> package has been upgraded

View file

@ -157,6 +157,10 @@ In addition to numerous new and upgraded packages, this release has the followin
- `services.miniflux.adminCredentialFiles` is now required, instead of defaulting to `admin` and `password`.
- The `taskserver` module no longer implicitly opens ports in the firewall
configuration. This is now controlled through the option
`services.taskserver.openFirewall`.
- The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.
- For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`

View file

@ -277,10 +277,6 @@ in {
example = "::";
description = ''
The address (IPv4, IPv6 or DNS) to listen on.
If the value is something else than <literal>localhost</literal> the
port defined by <option>listenPort</option> is automatically added to
<option>networking.firewall.allowedTCPPorts</option>.
'';
};
@ -292,6 +288,14 @@ in {
'';
};
openFirewall = mkOption {
type = types.bool;
default = false;
description = ''
Whether to open the firewall for the specified Taskserver port.
'';
};
fqdn = mkOption {
type = types.str;
default = "localhost";
@ -560,7 +564,7 @@ in {
'';
};
})
(mkIf (cfg.enable && cfg.listenHost != "localhost") {
(mkIf (cfg.enable && cfg.openFirewall) {
networking.firewall.allowedTCPPorts = [ cfg.listenPort ];
})
];

View file

@ -63,6 +63,7 @@ in {
server = {
services.taskserver.enable = true;
services.taskserver.listenHost = "::";
services.taskserver.openFirewall = true;
services.taskserver.fqdn = "server";
services.taskserver.organisations = {
testOrganisation.users = [ "alice" "foo" ];