all repos — nixfiles @ 9eefb41c335dfae6b349312cb886d9823bea3eb0

System and user configuration, managed by nix and home-manager

satoshipay: enable docker container->host connections

Alan Pearce
commit

9eefb41c335dfae6b349312cb886d9823bea3eb0

parent

12cb5d6e10888d095cd6f1a6cf2f201684e21583

1 file changed, 17 insertions(+), 10 deletions(-)

jump to
M system/settings/satoshipay.nix → system/settings/satoshipay.nix
@@ -1,20 +1,21 @@
 { config, pkgs, fetchurl, lib, ... }:
 
+let
+  dockerConfig = {
+    ipv6 = true;
+    fixed-cidr-v6 = "fd69:2074:9fcd:b0fd::/64";
+    features = {
+      buildkit = true;
+    };
+  };
+in
 { virtualisation = {
-  docker = let
-    daemonConfig = {
-      ipv6 = true;
-      fixed-cidr-v6 = "fd69:2074:9fcd:b0fd::/64";
-      features = {
-        buildkit = true;
-      };
-    };
-    in {
+  docker = {
       enable = true;
       enableOnBoot = false;
       liveRestore = false;
 
-      extraOptions = "--config-file=${pkgs.writeText "daemon.json" (builtins.toJSON daemonConfig)}";
+      extraOptions = "--config-file=${pkgs.writeText "daemon.json" (builtins.toJSON dockerConfig)}";
 
       autoPrune = {
         enable = true;

@@ -22,6 +23,12 @@ dates = "Mon, 13:00";
       };
     };
   };
+  networking.firewall.extraCommands = ''
+    iptables  -A nixos-fw -p udp --source 172.17.0.0/24         -j nixos-fw-accept
+    iptables  -A nixos-fw -p tcp --source 172.17.0.0/24         -j nixos-fw-accept
+    ip6tables -A nixos-fw -p tcp --source ${dockerConfig.fixed-cidr-v6} -j nixos-fw-accept
+    ip6tables -A nixos-fw -p udp --source ${dockerConfig.fixed-cidr-v6} -j nixos-fw-accept
+  '';
 
   services.mongodb = {
     enable = true;