diff options
author | Emily <git@emilylange.de> | 2023-12-03 20:37:09 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-12-03 20:37:09 +0100 |
commit | a0ba4615da4053ce59c6367a3aa276c1a8d24d9e (patch) | |
tree | b107bc49ddd66126faf31c67475e6350623154c3 /nixos | |
parent | de502c4d0ba96261e5de803e4d1d1925afd3e22f (diff) | |
parent | 24d9151d15168867b87669ee663e4d15a23ded91 (diff) | |
download | nixlib-a0ba4615da4053ce59c6367a3aa276c1a8d24d9e.tar nixlib-a0ba4615da4053ce59c6367a3aa276c1a8d24d9e.tar.gz nixlib-a0ba4615da4053ce59c6367a3aa276c1a8d24d9e.tar.bz2 nixlib-a0ba4615da4053ce59c6367a3aa276c1a8d24d9e.tar.lz nixlib-a0ba4615da4053ce59c6367a3aa276c1a8d24d9e.tar.xz nixlib-a0ba4615da4053ce59c6367a3aa276c1a8d24d9e.tar.zst nixlib-a0ba4615da4053ce59c6367a3aa276c1a8d24d9e.zip |
Merge pull request #270467 from nalves599/269944-keepalived-firewall
nixos/keepalived: add openFirewall option
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/services/networking/keepalived/default.nix | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/nixos/modules/services/networking/keepalived/default.nix b/nixos/modules/services/networking/keepalived/default.nix index 29fbea5545c3..429a47c3962c 100644 --- a/nixos/modules/services/networking/keepalived/default.nix +++ b/nixos/modules/services/networking/keepalived/default.nix @@ -150,6 +150,14 @@ in ''; }; + openFirewall = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Whether to automatically allow VRRP and AH packets in the firewall. + ''; + }; + enableScriptSecurity = mkOption { type = types.bool; default = false; @@ -282,6 +290,19 @@ in assertions = flatten (map vrrpInstanceAssertions vrrpInstances); + networking.firewall = lib.mkIf cfg.openFirewall { + extraCommands = '' + # Allow VRRP and AH packets + ip46tables -A nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ip46tables -A nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ''; + + extraStopCommands = '' + ip46tables -D nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ip46tables -D nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT + ''; + }; + systemd.timers.keepalived-boot-delay = { description = "Keepalive Daemon delay to avoid instant transition to MASTER state"; after = [ "network.target" "network-online.target" "syslog.target" ]; |