greg/nixos
1
0
Fork 2
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Update ZWaveJS

Browse Source 
Update to newer version of ZWaveJS container
Update firewall rules to permit access to podman0
This commit is contained in:
Greg Hellings
2023-08-31 08:01:46 -05:00
parent 1d3c7eaa03
commit 03edc9a8af
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/genesis/home-assistant.nix
+4 -1
View File
@@ -51,13 +51,16 @@ in
# I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up # I have ZWave devices. The easiest way to connect to them is the zwavejs2mqtt service running, so we spin up
# its container and map the ZWave device into it # its container and map the ZWave device into it
containers.zwave = { containers.zwave = {
image = "zwavejs/zwavejs2mqtt:latest"; image = "zwavejs/zwave-js-ui:latest";
ports = [ "8091:8091" "3000:3000" ]; ports = [ "8091:8091" "3000:3000" ];
volumes = [ "/var/lib/zwave:/usr/src/app/store" ]; volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
extraOptions = [ extraOptions = [
"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave" "--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
"--pull=newer" "--pull=newer"
]; ];
environment = {
TZ = "America/Chicago";
};
}; };
}; };
hosts/genesis/nftables.nft
+7 -3
View File
@@ -8,7 +8,6 @@ table ip filter {
counter tcp_dns {} counter tcp_dns {}
counter udp_dns {} counter udp_dns {}
counter catchall {} counter catchall {}
counter sus {}
chain output { chain output {
type filter hook output priority 100; policy accept; type filter hook output priority 100; policy accept;
@@ -18,7 +17,6 @@ table ip filter {
type filter hook input priority 0; policy drop; type filter hook input priority 0; policy drop;
iifname lo accept iifname lo accept
iifname $SUS counter name sus
# Router needs to yield up DNS and DHCP for itself, in my case # Router needs to yield up DNS and DHCP for itself, in my case
iifname $LAN tcp dport { 53, 67 } counter name tcp_dns accept iifname $LAN tcp dport { 53, 67 } counter name tcp_dns accept
@@ -31,15 +29,20 @@ table ip filter {
iifname $FRIENDS udp dport {{ port }} accept iifname $FRIENDS udp dport {{ port }} accept
{% endfor %} {% endfor %}
iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing" #iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing"
iifname {{ wanInterface }} ct state { established, related } accept comment "Allows existing connections" iifname {{ wanInterface }} ct state { established, related } accept comment "Allows existing connections"
iifname {{ wanInterface }} icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic" iifname {{ wanInterface }} icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic"
iifname {{ wanInterface }} counter drop comment "Drop other incoming traffic, and count how much" iifname {{ wanInterface }} counter drop comment "Drop other incoming traffic, and count how much"
iifname "podman0" ct state { established, related } accept comment "Allows existing connections"
iifname "podman0" icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic"
iifname "podman0" counter drop comment "Drop other incoming traffic, and count how much"
} }
chain forward { chain forward {
type filter hook forward priority 0; policy drop; type filter hook forward priority 0; policy drop;
iifname $LAN oifname {{ wanInterface }} accept comment "Forward LAN to WAN" iifname $LAN oifname {{ wanInterface }} accept comment "Forward LAN to WAN"
iifname {{ wanInterface }} oifname $LAN ct state established, related accept comment "Allow incoming established traffic" iifname {{ wanInterface }} oifname $LAN ct state established, related accept comment "Allow incoming established traffic"
iifname $LAN oifname "podman0" accept comment "Forward LAN to WAN"
iifname "podman0" oifname $LAN ct state established, related accept comment "Allow incoming established traffic"
} }
} }
@@ -47,6 +50,7 @@ table ip nat {
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; policy accept; type nat hook postrouting priority 100; policy accept;
oifname { {{ wanInterface }} } masquerade oifname { {{ wanInterface }} } masquerade
oifname "podman0" masquerade
} }
} }