Put in earplugs
This commit is contained in:
parent
05f88e0273
commit
197d20e981
GPG key ID:
989F5E6EDB478160
4 changed files with 47 additions and 18 deletions
|
|
@ -229,7 +229,7 @@ use dovecot for local IMAP
|
|||
#+end_src
|
||||
|
||||
*** iptables
|
||||
=iptables= configuration to allow SSH on port 22, IMAPS on 993, wireguard (wg0), mDNS and local smb for 192.168.0.0/16
|
||||
=iptables= configuration to allow SSH on port 22, IMAPS on 993, wireguard (wg0), syncthing, mDNS and local smb for 192.168.0.0/16
|
||||
|
||||
#+BEGIN_SRC scheme :session
|
||||
(service iptables-service-type
|
||||
|
|
@ -267,7 +267,12 @@ wireguard
|
|||
-A INPUT -i wg0 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
-A FORWARD -i wg0 -j ACCEPT
|
||||
#+end_src
|
||||
|
||||
syncthing
|
||||
#+BEGIN_SRC scheme
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 8384 -j ACCEPT
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 21027 -j ACCEPT
|
||||
#+END_SRC
|
||||
otherwise
|
||||
#+BEGIN_SRC scheme
|
||||
-A INPUT -j REJECT --reject-with icmp-port-unreachable
|
||||
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
||||
|
|
@ -306,7 +311,12 @@ wireguard
|
|||
-A INPUT -i wg0 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
-A FORWARD -i wg0 -j ACCEPT
|
||||
#+end_src
|
||||
|
||||
syncthing
|
||||
#+BEGIN_SRC scheme
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 8384 -j ACCEPT
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 21027 -j ACCEPT
|
||||
#+END_SRC
|
||||
otherwise
|
||||
#+BEGIN_SRC scheme
|
||||
-A INPUT -j REJECT --reject-with icmp6-port-unreachable
|
||||
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
;; -*- mode: scheme; coding: utf-8; -*-
|
||||
;;
|
||||
;; tangled from framework13-system.org on 2024-06-18 12:53:06+02:00)
|
||||
;; tangled from framework13-system.org on 2024-08-02 11:16:35+02:00)
|
||||
|
||||
(use-modules (gnu)
|
||||
(gnu packages)
|
||||
|
|
@ -158,6 +158,9 @@ COMMIT
|
|||
-A INPUT -i wg0 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
-A FORWARD -i wg0 -j ACCEPT
|
||||
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 8384 -j ACCEPT
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 21027 -j ACCEPT
|
||||
|
||||
-A INPUT -j REJECT --reject-with icmp-port-unreachable
|
||||
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
||||
COMMIT
|
||||
|
|
@ -189,6 +192,9 @@ COMMIT
|
|||
-A INPUT -i wg0 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
-A FORWARD -i wg0 -j ACCEPT
|
||||
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 8384 -j ACCEPT
|
||||
-A INPUT -p tcp -s 192.168.0.0/16 --dport 21027 -j ACCEPT
|
||||
|
||||
-A INPUT -j REJECT --reject-with icmp6-port-unreachable
|
||||
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
||||
COMMIT
|
||||
|
|
@ -306,19 +312,24 @@ writable = yes
|
|||
(targets (list "/boot/efi"))
|
||||
(keyboard-layout keyboard-layout)))
|
||||
|
||||
(swap-devices (list (swap-space
|
||||
(target (file-system-label "swap")))))
|
||||
(mapped-devices (list (mapped-device
|
||||
(source (uuid
|
||||
"9b5d47cd-d865-4ec9-81ec-30565fa767e4"))
|
||||
(target "cryptroot")
|
||||
(type luks-device-mapping))))
|
||||
|
||||
(file-systems (cons* (file-system
|
||||
(mount-point "/boot/efi")
|
||||
(device (uuid "8B3C-3BC0" 'fat32))
|
||||
(type "vfat"))
|
||||
(file-system
|
||||
(mount-point "/")
|
||||
(device (uuid
|
||||
"e0ece027-0396-4546-8aba-2ce91285d061"
|
||||
'ext4))
|
||||
(type "ext4"))
|
||||
%base-file-systems))
|
||||
(file-systems (cons* (file-system
|
||||
(mount-point "/boot/efi")
|
||||
(device (uuid "0D77-7016" 'fat32))
|
||||
(type "vfat"))
|
||||
(file-system
|
||||
(mount-point "/")
|
||||
(device "/dev/mapper/cryptroot")
|
||||
(type "ext4")
|
||||
(dependencies mapped-devices)) %base-file-systems))
|
||||
|
||||
;; (swap-devices (list (swap-space
|
||||
;; (target (file-system-label "swap")))))
|
||||
(swap-devices `("/mnt/swapfile"))
|
||||
|
||||
) ;; end operating-system declaration
|
||||
|
|
|
|||
|
|
@ -240,6 +240,12 @@ the zsh dotfiles are added manually rather than using dotfiles-service (duplicat
|
|||
;; ssh config in 'dotfiles'
|
||||
#+END_SRC
|
||||
|
||||
*** syncthing
|
||||
using [[https://syncthing.net/][syncthing]] for local & point-to-point filesync across machines (see also nextcloud)
|
||||
#+BEGIN_SRC scheme
|
||||
(service home-syncthing-service-type)
|
||||
#+END_SRC
|
||||
|
||||
*** sound
|
||||
via pipewire which requires dbus (see also [[https://guix.gnu.org/manual/devel/en/html_node/Sound-Home-Services.html][guix manual]])
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
;; -*- mode: scheme; coding: utf-8; -*-
|
||||
;;
|
||||
;; tangled from home-configuration.org on 2024-04-14 14:56:58+02:00)
|
||||
;; tangled from home-configuration.org on 2024-08-02 11:17:18+02:00)
|
||||
|
||||
(use-modules (gnu)
|
||||
(gnu home)
|
||||
|
|
@ -149,6 +149,8 @@
|
|||
|
||||
;; ssh config in 'dotfiles'
|
||||
|
||||
(service home-syncthing-service-type)
|
||||
|
||||
(service home-dbus-service-type)
|
||||
|
||||
(service home-pipewire-service-type
|
||||
|
|
|
|||
Loading…
Reference in a new issue