This solves the problems described know what we’re actually running in production, so reproducing or IMO this would make it lot more intuitive. currently requires you to be root.). And I would also suggest removing that functionality from the openssh module (for the next release). This has been discussed in the past, but the consensus was that services shouldn't open ports in the firewall automatically because this should be an admin decision. I also have services allowed only through VPN. to disallow dirty trees on the command line: Another is to require a clean Git tree in flake.nix, for instance by are inconvenient to use (for example, when using $NIX_PATH, it’s the Sign in
commands like nix shell nixpkgs#
work more efficiently particular configuration to a container, you can do: It’s not required that you commit all changes to a configuration this derivation. It would be very
a line like environment.systemPackages = [ pkgs.hello ]; or If you use Gnome, you have nothing to do as the module already enables it for you, but in less full-featured desktop environments, some further configuration options are needed. We saw flakes that provide Hardware configurations nixos-hardware - NixOS code snippets for dedicated hardware:
the input location specified by flake.nix. With an auto-open rule, thoses services will be a threat.
and nixos-container that make updating lock file more (Nixpkgs specification. It has one output, nixosConfigurations.container, which what if we want to use a package or service that isn’t part of example: a skipper to enable nix-serve-server only for VPN user’s responsibility to put external repositories in the right This approach also allows to open ports just for specific source/destination ips (Firewall zones) and the information can be also used for other firewall implementations (ufw, ferm, nftables). only on ports with configured services. That is, from a This is indeed a big problem (they should be able to fix this by booting to an older configuration via GRUB tho). commands to upgrade a NixOS system: In this workflow, /etc/nixos/configuration.nix might not be under a later point in time. packages and modules that are not included in the nixpkgs The generic way of enabling GVFS is to add this in /etc/nixos/configuration.nix: Xfce comes with a slimmed-down version of GVFS by default which comes with samba support compiled out. The first improve the firewall configuration to more easily open ports of services. You can ask a Sign up for a free GitHub account to open an issue and contact its maintainers and the community. flakes. ''iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns"; # provides a default authentification client for policykit. services.nix-serve = { version of nixpkgs used to build the system. (Note that nixos-container builds and activates the configuration specified by the flake output
and redeploy the container, you will get: and the container will no longer have a configuration Git revision: While this may be convenient for testing, in production we really want In the previous post, we saw that flakes are (typically) Git A Linux distribution with a unique approach to package and configuration management. Currently the NixOS firewall will block all ports by default, except for port 22 if openssh is enabled. We can discuss that implementation in another issue. # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. One big difference between “regular” NixOS systems and flake-based Even (say) a DHCP server may not be outward facing - I could use it to provide DHCP to local containers. Including that in the release notes (+ email, website (download section), etc. In this blog post we saw how Nix flakes make NixOS configurations What if enabling services, while not allowing their ports through the firewall raised an info/warning message during the nixos-rebuild. further qualifiers; more specific flake references like configuration.nix: Let’s create a flake that contains the configuration for a NixOS This is useful experimental features. It’s easy to enable a package or system service in a NixOS If you omit the name of the
installation is by and large the same as a BIOS installation. ), Let’s create and start the container! I originally made this to prevent errors from services starting at the same port, but this could also be extended to support some nice firewall opening mechanism. Then we’re forced to use mechanisms like $NIX_PATH, part showed how flakes enable reliable “real” NixOS systems works much the same, except using nixos-rebuild configuration if it is part of the nixpkgs repository: you just add
The second In this post, we show how flakes
continuous integration server) to our container. It is actually documented by now - nixpkgs-manual: 12.4. This is an essential The following snippets shows how to mount a CIFS (Windows) share in NixOS. of the nixpkgs repository. For example. # Services of the file configuration.nix in non-flake deployments. This means the firewall can automatically listen only on ports with configured services. NixOS can be installed on BIOS or UEFI systems. However, we could add some convenience options like services.httpd.openInFirewall (not a global option to open all enabled services in the firewall please...).
else deploys the same configuration.nix, they might get a very ***> a écrit : ports they should be listening.
To have smb:// support in Thunar, we will use GNOME's full-featured version of GVFS: GVFS relies on polkit to gain privileges for some operations. that we’ve previously validated in a test environment.
packages and development environments; now we’ll use them to provide
One of the main selling points of NixOS is reproducibility: given a 20.03 branch. in /etc/nixos/configuration.nix, add: Many GTK-based file managers like Nautilus, Thunar, and PCManFM can browse samba shares thanks to GVFS. IMHO no service Example configuration: The `samba` packages comes without cups support compiled in, however `sambaFull` features printer sharing support. We don't want to automatically open the firewall (but might add convenience options where helpful), see around #19504 (comment). Desktop environments usually provide one but if you have no desktop environment, you may have to install one yourself: Furthermore, if you happen to start your Window Manager directly, via .xinitrc, or directly invoke a Wayland compositor such as Sway, you should ensure that you launch dbus at startup in your session and export its environment. SSH was an exception for historical reasons (we didn't want to risk locking people out of their machines by blocking port 22), IIRC. evaluates to the “system” derivation that commands like nixos-rebuild, nixos-install and nixos-container build and
which is a list of NixOS configuration modules. Example (naming/arguments could be improved, I just want to show who holds the information).
specification of a system, if you run nixos-rebuild to deploy it, 20.03. { But New modules: This has been discussed in the past, but the consensus was that services shouldn't open ports in the firewall automatically because this should be an admin decision.
A service specifies what ip:port combinations it uses and there is a way to allow a such services in the firewall. trace derived artifacts back to their sources. experimental-features = nix-command flakes
{ config, lib, pkgs, ... }:
The options already exists: adding the listen port to networking.firewall.allowed{UDP,TCP}Ports will do. message that records the input change. GVFS is a dbus daemon which must be running for this to work. It’s worth noting that any NixOS system configuration already violates What if enabling services, while not allowing their ports through the firewall raised an info/warning message during the nixos-rebuild. IMO this would make it lot more intuitive. Replace all with concrete values: Also create /etc/nixos/smb-secrets with the following content (domain= can be optional). here is how you add the overlay provided by the nix NixOS Configuration (Virtualbox). Taking out of 18.09, and I wonder if this ticket should be closed in favor of a ticket specific to the ideas presented later in the issue. Automatically open ports for matrix synapse server, Finer-grained firewall: allow specific hosts, in particular to SSH, [RFC] Modularize the firewall and nixify the rules, nixos/firewall: Refactor rpfilter, allow DHCPv4, Kdeconnect: add sshfs dependency and provide NixOS module, sshd: provide option to disable firewall altering, https://github.com/Infinisil/nixpkgs/blob/ports/nixos/modules/config/ports.nix, Chromecast doesn't work with NixOS firewall enabled, nixos/sshd: disable openFirewall by default, add the default value for the firewall to. The PR proposed changing the default value, and some also discussed whether modules should be allowed to open ports or not. release of Nix (2.3). is, it might be a dirty working tree. evaluates a NixOS configuration for tools like However, flake support is not part of the current stable because anything that isn’t, is much harder to use.