summaryrefslogtreecommitdiff
path: root/installer
diff options
context:
space:
mode:
authorGregor Kleen <gkleen@yggdrasil.li>2022-03-12 18:40:38 +0100
committerGregor Kleen <gkleen@yggdrasil.li>2022-03-12 18:40:38 +0100
commitae278d745dd8eca94374b27c1fa9a977e54c23c2 (patch)
tree934702c425a46496b046579b6f3f4bacada36e4a /installer
parent1f4ff029be789298f7732d6f2a153a234cbb5267 (diff)
downloadnixos-ae278d745dd8eca94374b27c1fa9a977e54c23c2.tar
nixos-ae278d745dd8eca94374b27c1fa9a977e54c23c2.tar.gz
nixos-ae278d745dd8eca94374b27c1fa9a977e54c23c2.tar.bz2
nixos-ae278d745dd8eca94374b27c1fa9a977e54c23c2.tar.xz
nixos-ae278d745dd8eca94374b27c1fa9a977e54c23c2.zip
vidhar: netboot installer
Diffstat (limited to 'installer')
-rw-r--r--installer/default.nix32
-rw-r--r--installer/ruleset.nft98
2 files changed, 130 insertions, 0 deletions
diff --git a/installer/default.nix b/installer/default.nix
new file mode 100644
index 00000000..bf09c8d8
--- /dev/null
+++ b/installer/default.nix
@@ -0,0 +1,32 @@
1{ flake, pkgs, ... }: {
2 imports = with flake.nixosModules.systemProfiles; [
3 default-locale zfs networkmanager openssh
4 ];
5
6 config = {
7 networking = {
8 firewall.enable = false;
9 nftables = {
10 enable = true;
11 rulesetFile = ./ruleset.nft;
12 };
13 };
14
15 services.openssh = {
16 enable = true;
17 staticHostKeys = false;
18 };
19
20 services.qemuGuest.enable = true;
21
22 services.resolved = {
23 llmnr = "false";
24 };
25
26 environment.systemPackages = with pkgs; [
27 nvme-cli iotop mosh
28 ];
29
30 zramSwap.enable = true;
31 };
32}
diff --git a/installer/ruleset.nft b/installer/ruleset.nft
new file mode 100644
index 00000000..4de54dd7
--- /dev/null
+++ b/installer/ruleset.nft
@@ -0,0 +1,98 @@
1define icmp_protos = {ipv6-icmp, icmp, igmp}
2
3table arp filter {
4 limit lim_arp {
5 rate over 50 mbytes/second burst 50 mbytes
6 }
7
8 chain input {
9 type filter hook input priority filter
10 policy accept
11
12 limit name lim_arp counter drop
13
14 counter
15 }
16
17 chain output {
18 type filter hook output priority filter
19 policy accept
20
21 limit name lim_arp counter drop
22
23 counter
24 }
25}
26
27table inet filter {
28 limit lim_reject {
29 rate over 1000/second burst 1000 packets
30 }
31
32 limit lim_icmp {
33 rate over 50 mbytes/second burst 50 mbytes
34 }
35
36
37 chain forward {
38 type filter hook forward priority filter
39 policy drop
40
41
42 ct state invalid log level debug prefix "drop invalid forward: " counter drop
43
44
45 iifname lo counter accept
46
47
48 limit name lim_reject log level debug prefix "drop forward: " counter drop
49 log level debug prefix "reject forward: " counter
50 meta l4proto tcp ct state new counter reject with tcp reset
51 ct state new counter reject
52
53
54 counter
55 }
56
57 chain input {
58 type filter hook input priority filter
59 policy drop
60
61
62 ct state invalid log level debug prefix "drop invalid input: " counter drop
63
64
65 iifname lo counter accept
66 iif != lo ip daddr 127.0.0.1/8 counter reject
67 iif != lo ip6 daddr ::1/128 counter reject
68
69 meta l4proto $icmp_protos limit name lim_icmp counter drop
70 meta l4proto $icmp_protos counter accept
71
72 tcp dport 22 counter accept
73 udp dport 60000-61000 counter accept
74
75
76 limit name lim_reject log level debug prefix "drop input: " counter drop
77 log level debug prefix "reject input: " counter
78 meta l4proto tcp ct state new counter reject with tcp reset
79 ct state new counter reject
80
81
82 counter
83 }
84
85 chain output {
86 type filter hook output priority filter
87 policy accept
88
89
90 oifname lo counter accept
91
92 meta l4proto $icmp_protos limit name lim_icmp counter drop
93 meta l4proto $icmp_protos counter accept
94
95
96 counter
97 }
98} \ No newline at end of file