rarias/jungle
2
0
Fork 3
Code Issues 57 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

MERGEME: Only expose proxy to docker

Browse Source
This commit is contained in:
Rodrigo Arias
2025-02-17 15:28:24 +01:00
parent ab82757b42
commit ea49d762d1
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
m/hut/configuration.nix
View File

@@ -55,8 +55,6 @@
# Accept all proxy traffic from compute nodes but not the login
iptables -A nixos-fw -p tcp -s 10.0.40.30 --dport 23080 -j nixos-fw-log-refuse
iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 23080 -j nixos-fw-accept
# Allow docker to use our proxy
iptables -A nixos-fw -p tcp -i docker0 -d hut --dport 23080 -j nixos-fw-accept
'';
};
};

8
m/hut/gitlab-runner.nix
View File

@@ -97,6 +97,14 @@
};
};
# DOCKER* chains are useless, override at FORWARD
networking.firewall.extraCommands = ''
# Allow docker to use our proxy
iptables -I FORWARD 1 -p tcp -i docker0 -d hut --dport 23080 -j nixos-fw-accept
# Block anything else coming from docker
iptables -I FORWARD 2 -p all -i docker0 -j nixos-fw-log-refuse
'';
#systemd.services.gitlab-runner.serviceConfig.Shell = "${pkgs.bash}/bin/bash";
systemd.services.gitlab-runner.serviceConfig.DynamicUser = lib.mkForce false;
systemd.services.gitlab-runner.serviceConfig.User = "gitlab-runner";