greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Update ZWaveJS

Browse Source 
Update to newer version of ZWaveJS container
Update firewall rules to permit access to podman0
This commit is contained in:
Greg Hellings
2023-08-31 08:01:46 -05:00
parent 1d3c7eaa03
commit 03edc9a8af
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/genesis/home-assistant.nix
+4 -1
View File
@@ -51,13 +51,16 @@ in
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
# its container and map the ZWave device into it
containers.zwave = {
image = "zwavejs/zwavejs2mqtt:latest";
image = "zwavejs/zwave-js-ui:latest";
ports = [ "8091:8091" "3000:3000" ];
volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
extraOptions = [
"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
"--pull=newer"
];
environment = {
TZ = "America/Chicago";
};
};
};
hosts/genesis/nftables.nft
+7 -3
View File
@@ -8,7 +8,6 @@ table ip filter {
counter tcp_dns {}
counter udp_dns {}
counter catchall {}
counter sus {}
chain output {
type filter hook output priority 100; policy accept;
@@ -18,7 +17,6 @@ table ip filter {
type filter hook input priority 0; policy drop;
iifname lo accept
iifname $SUS counter name sus
# Router needs to yield up DNS and DHCP for itself, in my case
iifname $LAN tcp dport { 53, 67 } counter name tcp_dns accept
@@ -31,15 +29,20 @@ table ip filter {
iifname $FRIENDS udp dport {{ port }} accept
{% endfor %}
iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing"
#iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing"
iifname {{ wanInterface }} ct state { established, related } accept comment "Allows existing connections"
iifname {{ wanInterface }} icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic"
iifname {{ wanInterface }} counter drop comment "Drop other incoming traffic, and count how much"
iifname "podman0" ct state { established, related } accept comment "Allows existing connections"
iifname "podman0" icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic"
iifname "podman0" counter drop comment "Drop other incoming traffic, and count how much"
}
chain forward {
type filter hook forward priority 0; policy drop;
iifname $LAN oifname {{ wanInterface }} accept comment "Forward LAN to WAN"
iifname {{ wanInterface }} oifname $LAN ct state established, related accept comment "Allow incoming established traffic"
iifname $LAN oifname "podman0" accept comment "Forward LAN to WAN"
iifname "podman0" oifname $LAN ct state established, related accept comment "Allow incoming established traffic"
}
}
@@ -47,6 +50,7 @@ table ip nat {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname { {{ wanInterface }} } masquerade
oifname "podman0" masquerade
}
}