diff options
| author | lassulus <git@lassul.us> | 2023-06-21 16:01:33 +0200 |
|---|---|---|
| committer | lassulus <git@lassul.us> | 2023-06-21 16:01:33 +0200 |
| commit | a0c4427c0baa94603fa10c1248944e7837e72642 (patch) | |
| tree | caa4053366d62b683e6f6e746e9df0317de88c80 /tv | |
| parent | c6593fdb393a585e631b9824e2bb3857ba2f90c6 (diff) | |
| parent | fdc364520238a38883d28bbfa05ac966e792ed8b (diff) | |
Merge remote-tracking branch 'ni/flakify'
Diffstat (limited to 'tv')
| -rw-r--r-- | tv/2configs/sshd.nix | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix index 0610e3c98..59c95ccba 100644 --- a/tv/2configs/sshd.nix +++ b/tv/2configs/sshd.nix @@ -1,6 +1,9 @@ with import ./lib; { config, ... }: let cfg.host = config.krebs.build.host; + nets = + optional (cfg.host.nets?retiolum) cfg.host.nets.retiolum ++ + optional (cfg.host.nets?wiregrill) cfg.host.nets.wiregrill; in { services.openssh = { enable = true; @@ -12,15 +15,11 @@ in { tv.iptables.extra4.nat.PREROUTING = map (net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT") - (filter (net: net.ip4 != null) - [ - cfg.host.nets.retiolum - cfg.host.nets.wiregrill - ]); - tv.iptables.extra6.nat.PREROUTING = [ - "-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT" - "-d ${cfg.host.nets.wiregrill.ip6.addr} -p tcp --dport 22 -j ACCEPT" - ]; + (filter (net: net.ip4 != null) nets); + tv.iptables.extra6.nat.PREROUTING = + map + (net: "-d ${net.ip6.addr} -p tcp --dport 22 -j ACCEPT") + (filter (net: net.ip6 != null) nets); tv.iptables.extra.nat.PREROUTING = [ "-p tcp --dport 22 -j REDIRECT --to-ports 0" "-p tcp --dport 11423 -j REDIRECT --to-ports 22" |