tv: modularize iptables configuration

1 files changed, 16 insertions, 1 deletions

diff --git a/modules/cd/default.nix b/modules/cd/default.nix
index 6884c67f..21d9565f 100644
--- a/modules/cd/default.nix
+++ b/modules/cd/default.nix
@@ -8,7 +8,6 @@ in
   imports =
     [
       <secrets/hashedPasswords.nix>
-      ./iptables.nix
       ./networking.nix
       ./users.nix
       ../common/nixpkgs.nix
@@ -19,6 +18,22 @@ in
       ../tv/git/public.nix
       ../tv/retiolum.nix
       ../tv/sanitize.nix
+      {
+        imports = [ ../tv/iptables ];
+        tv.iptables = {
+          enable = true;
+          input-internet-accept-new-tcp = [
+            "ssh"
+            "tinc"
+            "smtp"
+            "xmpp-client"
+            "xmpp-server"
+          ];
+          input-retiolum-accept-new-tcp = [
+            "http"
+          ];
+        };
+      }
     ];
 
   # "Developer 2" plan has two vCPUs.