diff options
author | William A. Kennington III <william@wkennington.com> | 2015-07-26 16:32:59 -0700 |
---|---|---|
committer | William A. Kennington III <william@wkennington.com> | 2015-07-26 16:33:03 -0700 |
commit | abc7c1b013ac2dc9a86e3161c6913062550cca13 (patch) | |
tree | 2d0a6acb446aea2c51d506ee54382c9b689d88d7 /nixos | |
parent | f07b2121f9dc23f6a69bbc815e7991c7f52fe551 (diff) | |
download | nixlib-abc7c1b013ac2dc9a86e3161c6913062550cca13.tar nixlib-abc7c1b013ac2dc9a86e3161c6913062550cca13.tar.gz nixlib-abc7c1b013ac2dc9a86e3161c6913062550cca13.tar.bz2 nixlib-abc7c1b013ac2dc9a86e3161c6913062550cca13.tar.lz nixlib-abc7c1b013ac2dc9a86e3161c6913062550cca13.tar.xz nixlib-abc7c1b013ac2dc9a86e3161c6913062550cca13.tar.zst nixlib-abc7c1b013ac2dc9a86e3161c6913062550cca13.zip |
nixos/firewall: Add the ability to specify additional packages for extraCommands
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/services/networking/firewall.nix | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 21f8ae243a7f..a61f0250ef8b 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -420,6 +420,16 @@ in ''; }; + networking.firewall.extraPackages = mkOption { + default = [ ]; + example = [ pkgs.ipset ]; + description = + '' + Additional packages to be included in the environment of the system + as well as the path of networking.firewall.extraCommands. + ''; + }; + networking.firewall.extraStopCommands = mkOption { type = types.lines; default = ""; @@ -443,7 +453,7 @@ in networking.firewall.trustedInterfaces = [ "lo" ]; - environment.systemPackages = [ pkgs.iptables ]; + environment.systemPackages = [ pkgs.iptables ] ++ cfg.extraPackages; boot.kernelModules = map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules; boot.extraModprobeConfig = optionalString (!cfg.autoLoadConntrackHelpers) '' @@ -462,7 +472,7 @@ in before = [ "network-pre.target" ]; after = [ "systemd-modules-load.service" ]; - path = [ pkgs.iptables ]; + path = [ pkgs.iptables ] ++ cfg.extraPackages; # FIXME: this module may also try to load kernel modules, but # containers don't have CAP_SYS_MODULE. So the host system had |