pleb/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netns-isolation: netns architecture

Browse Source 
- Adds network namespace instantiation and routing architecture.
- netns-isolation disabled by default. Can be enabled with
  configuration.nix FIXME.
- Uses mkMerge to toggle certain options for non netns and netns
  systems.
- Adds security wrapper for netns-exec which allows operator to exec
  with cap_sys_admin
- User can select the 169.254.N.0/24 addressblock netns's are created in.
- nix-bitcoin-services IpAddressAllow is amended with link-local
  addresses
This commit is contained in:
nixbitcoin
2020-07-21 09:38:20 +00:00
parent 4a7199a3da
commit e5e07b91f7
5 changed files with 181 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nix-bitcoin-services.nix
+1 -1
View File
@@ -36,7 +36,7 @@ with lib;
nodejs = { MemoryDenyWriteExecute = "false"; };
# Allow tor traffic. Allow takes precedence over Deny.
allowTor = {
IPAddressAllow = "127.0.0.1/32 ::1/128";
IPAddressAllow = "127.0.0.1/32 ::1/128 169.254.0.0/16";
};
# Allow any traffic
allowAnyIP = { IPAddressAllow = "any"; };