101 lines
2.3 KiB
Nix
101 lines
2.3 KiB
Nix
# Shared configuration for user firewall tests
|
|
{ self, pkgs, ... }:
|
|
{
|
|
imports = [
|
|
self.nixosModules.user-firewall
|
|
];
|
|
|
|
networking.firewall.enable = true;
|
|
|
|
# Configure the user firewall module
|
|
# Test with default allowedInterfaces (which includes wg*)
|
|
networking.user-firewall = {
|
|
# Use defaults for allowedInterfaces to test that wg* is included by default
|
|
exemptUsers = [
|
|
"root"
|
|
"alice"
|
|
];
|
|
};
|
|
|
|
# Create test users
|
|
users.users = {
|
|
alice = {
|
|
isNormalUser = true;
|
|
uid = 1001;
|
|
initialPassword = "test";
|
|
};
|
|
|
|
bob = {
|
|
isNormalUser = true;
|
|
uid = 1002;
|
|
initialPassword = "test";
|
|
};
|
|
};
|
|
|
|
# Add tools for testing
|
|
environment.systemPackages = with pkgs; [
|
|
curl
|
|
netcat
|
|
iproute2
|
|
];
|
|
|
|
# Add a local web server for testing
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"localhost" = {
|
|
listen = [
|
|
{
|
|
addr = "127.0.0.1";
|
|
port = 8080;
|
|
}
|
|
];
|
|
locations."/" = {
|
|
return = "200 'test server response'";
|
|
extraConfig = "add_header Content-Type text/plain;";
|
|
};
|
|
};
|
|
"wg0-test" = {
|
|
listen = [
|
|
{
|
|
addr = "10.100.0.2";
|
|
port = 8081;
|
|
}
|
|
{
|
|
addr = "[fd00::2]";
|
|
port = 8081;
|
|
}
|
|
];
|
|
locations."/" = {
|
|
return = "200 'wg0 interface test response'";
|
|
extraConfig = "add_header Content-Type text/plain;";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# Create a dummy interface to test allowed interface patterns
|
|
systemd.services.setup-wg0-interface = {
|
|
description = "Setup wg0 dummy interface";
|
|
after = [ "network-pre.target" ];
|
|
before = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
${pkgs.iproute2}/bin/ip link add wg0 type dummy || true
|
|
${pkgs.iproute2}/bin/ip addr add 10.100.0.2/24 dev wg0 || true
|
|
${pkgs.iproute2}/bin/ip addr add fd00::2/64 dev wg0 || true
|
|
${pkgs.iproute2}/bin/ip link set wg0 up || true
|
|
'';
|
|
};
|
|
|
|
# Make nginx wait for the wg0 interface
|
|
systemd.services.nginx = {
|
|
after = [ "setup-wg0-interface.service" ];
|
|
requires = [ "setup-wg0-interface.service" ];
|
|
};
|
|
}
|