diff options
Diffstat (limited to 'modules/common.nix')
| -rw-r--r-- | modules/common.nix | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/modules/common.nix b/modules/common.nix index e5c38d4..e27d276 100644 --- a/modules/common.nix +++ b/modules/common.nix @@ -15,10 +15,13 @@ }; }; - # Firewall: only allow SSH, HTTP, HTTPS, and DNS (for AdGuard) + # Firewall: SSH, HTTP/HTTPS (Caddy), plain DNS, and AdGuard's own + # DNS-over-TLS (853) + DNS-over-HTTPS (8443) listeners. + # Port 3000 (AdGuard's plain-HTTP web UI) is deliberately NOT opened here - + # see modules/adguard.nix for why it still binds 0.0.0.0 anyway. networking.firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 53 ]; + allowedTCPPorts = [ 22 80 443 53 853 8443 ]; allowedUDPPorts = [ 53 ]; }; @@ -47,10 +50,13 @@ sops ]; - # Automatic security updates for the OS + # Automatic security updates for the OS. + # This repo is self-hosted via cgit (modules/cgit.nix), so the flake URL + # below points at this same server rather than GitHub - update the repo + # name if you push this config somewhere else. system.autoUpgrade = { enable = false; # set to true once you are comfortable with unattended reboots - flake = "github:YOUR_USERNAME/nix#eurovm"; # update to your actual flake URL + flake = "git+https://git.karanj.com/feynman.git#eurovm"; flags = [ "--update-input" "nixpkgs" ]; }; } |