From 11ed9993db51a62d5364a423e1091884365d33fc Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sat, 30 May 2026 13:58:41 +0200
Subject: drop nixos firewall, use nftables directly

---
 hosts/sagittarius/network.nix    | 48 ++++++++++++++++++++++++++++++++++++++--
 hosts/sagittarius/web/blog.nix   |  4 ----
 hosts/sagittarius/web/static.nix |  4 ----
 3 files changed, 46 insertions(+), 10 deletions(-)

(limited to 'hosts/sagittarius')

diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
index 7dac324..ef5f66e 100644
--- a/hosts/sagittarius/network.nix
+++ b/hosts/sagittarius/network.nix
@@ -5,8 +5,52 @@
   networking = {
     hostName = "sagittarius";
     useNetworkd = true;
-    firewall = {
-      allowedTCPPorts = [ 22 ];
+    firewall.enable = false;
+    nftables = {
+      enable = true;
+      tables.filter = {
+        enable = true;
+        family = "inet";
+        content = ''
+          	set temp-ports {
+              type inet_proto . inet_service
+              flags interval
+              comment "Temporarily opened ports"
+            }
+
+          	chain rpfilter {
+              type filter hook prerouting priority mangle + 10; policy drop;
+              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
+              fib saddr . mark . iif check exists accept
+              jump rpfilter-allow
+            }
+
+            chain rpfilter-allow {
+            }
+
+            chain prerouting {
+              type filter hook prerouting priority mangle;
+              iifname "wg0" meta mark set 42
+            }
+
+            chain input {
+              type filter hook input priority filter; policy drop;
+              iifname "lo" accept comment "trusted interfaces"
+              icmpv6 type echo-reply accept
+              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
+            }
+
+            chain input-allow {
+              tcp dport { 22, 80, 443 } accept
+              udp dport 51820 accept
+              udp dport 5353 meta mark 42 accept comment "mDNS over wireguard"
+              meta l4proto . th dport @temp-ports accept
+              icmp type echo-request accept comment "allow ping"
+              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
+              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
+            }
+        '';
+      };
     };
   };
 
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
index d69ea20..b85b545 100644
--- a/hosts/sagittarius/web/blog.nix
+++ b/hosts/sagittarius/web/blog.nix
@@ -6,10 +6,6 @@
 }:
 {
   imports = [ ./acme.nix ];
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 
   services.nginx = {
     enable = true;
diff --git a/hosts/sagittarius/web/static.nix b/hosts/sagittarius/web/static.nix
index 88f1fa5..4ee5317 100644
--- a/hosts/sagittarius/web/static.nix
+++ b/hosts/sagittarius/web/static.nix
@@ -1,10 +1,6 @@
 { ... }:
 {
   imports = [ ./acme.nix ];
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 
   services.nginx = {
     enable = true;
-- 
cgit v1.3.1