Merge branch 'nixops' of ssh://git.fudo.org:2222/fudosys/NixOS into nixops

config/host-config/limina.nix

@@ -20,8 +20,6 @@ in {
       "openssh-with-gssapi-8.4p1" # CVE-2021-28041
     ];
 
-    fudo.hosts.limina.external-interfaces = [ "enp1s0" ];
-
     networking = {
       interfaces = {
         enp1s0 = { useDHCP = true; };
@@ -37,14 +35,25 @@ in {
         intif2 = { useDHCP = false; };
       };
 
+      # FIXME: this should be automatic
+      firewall.trustedInterfaces = [
+        "intif0"
+        "intif1"
+        "intif2"
+        "lo"
+        "docker0"
+      ];
+
       nat = {
         enable = true;
         externalInterface = "enp1s0";
-        internalInterfaces = [ "intif0" ];
+        internalInterfaces = [ "intif0" "intif1" "intif2" ];
       };
     };
 
     fudo = {
+      hosts.limina.external-interfaces = [ "enp1s0" ];
+      
       local-network = {
         enable = true;
         domain = domain-name;

config/profile-config/common.nix

@@ -56,7 +56,7 @@ in {
     };
 
     fail2ban = {
-      enable = true;
+      enable = config.networking.firewall.enable;
       bantime-increment.enable = true;
     };
 

lib/fudo/hosts/local-network.nix

@@ -6,6 +6,7 @@ with lib;
 let
   cfg = config.fudo.hosts.local-network;
 
+  # FIXME: this isn't used, is it?
   gatewayServerOpts = { ... }: {
     options = {
       enable = mkEnableOption "Turn this host into a network gateway.";