lyrathorpeandEmma Thorpe
c06a57f249
CI / flake (push) Successful in 3m30s
## Summary
Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).
## Changes
- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.
## Deferred (from #53, noted in the commit)
- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.
## Verification
- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).
Closes #50, #51, #52, #53.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54
39 lines
1.8 KiB
Nix
39 lines
1.8 KiB
Nix
# Docker host with the daemon socket exposed over the network.
|
|
#
|
|
# SECURITY: the daemon listens on plain TCP 2375 with NO TLS and NO auth. Access
|
|
# to that port is root-equivalent on this host (the Docker API can mount the
|
|
# host filesystem and run privileged containers). The ONLY thing protecting it
|
|
# is the nftables rule below, which accepts 2375 solely from the trusted LAN
|
|
# subnet. Do not widen that subnet to anything you do not fully trust. The
|
|
# secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
|
|
# that needs out-of-band cert provisioning and is intentionally not wired here.
|
|
{ ... }:
|
|
let
|
|
# LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
|
|
trustedSubnet = "10.187.1.0/24";
|
|
in
|
|
{
|
|
virtualisation.docker.enable = true;
|
|
|
|
# Expose the daemon over TCP by extending systemd socket activation rather than
|
|
# setting daemon.settings.hosts. The NixOS docker unit starts dockerd with
|
|
# `-H fd://` and takes its listeners from this socket; putting `hosts` in
|
|
# daemon.json as well would conflict with that and dockerd would refuse to
|
|
# start. Adding the TCP listener here keeps a single source of truth.
|
|
# The leading "" resets the unit's default (unix-socket-only) ListenStream list.
|
|
systemd.sockets.docker.socketConfig.ListenStream = [
|
|
""
|
|
"/run/docker.sock"
|
|
"0.0.0.0:2375"
|
|
];
|
|
|
|
# Source-restricted firewall rule for the Docker TCP port. 2375 is deliberately
|
|
# NOT added to networking.firewall.allowedTCPPorts (that would open it to every
|
|
# source); instead nftables accepts it only from the trusted subnet. Adjust the
|
|
# CIDR to match the LAN that should reach the Docker API.
|
|
networking.nftables.enable = true;
|
|
networking.firewall.extraInputRules = ''
|
|
ip saddr ${trustedSubnet} tcp dport 2375 accept
|
|
'';
|
|
}
|