rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

27
scripts/router-forwards-check.nix Normal file
View file

@ -0,0 +1,27 @@
{ lib }:
let
validate = import ../services/validate-forwards.nix { inherit lib; };
valid = builtins.fromTOML (builtins.readFile ../ports.toml);
accepts = data: (builtins.tryEval (builtins.deepSeq (validate data) true)).success;
extra = entry: valid // { forward = valid.forward ++ [ entry ]; };
forward = { name = "test"; port = 9999; protocol = "tcp"; };
invalid = [
(valid // { dest_default = "10.0.0.2"; })
(valid // { forward = builtins.filter (f: f.name != "SSH") valid.forward; })
(valid // { forward = map (f: if f.name == "HTTPS" then f // { dest = "10.0.0.2"; } else f) valid.forward; })
(extra (forward // { name = "bad\" label"; }))
(extra (forward // { name = "SSH"; }))
(extra (forward // { protocol = "sctp"; }))
(extra (forward // { dest = "10.0.0.5; accept"; }))
(extra (forward // { dest = "10.0.0.255"; }))
(extra (forward // { port = 0; }))
(extra (forward // { port = 65536; }))
(extra (forward // { ports = "10000-10001"; }))
(extra { name = "overlap"; ports = "25600-25601"; protocol = "udp"; })
(extra { name = "backwards"; ports = "9001-9000"; protocol = "udp"; })
];
in
assert accepts valid;
assert lib.all (data: !accepts data) invalid;
assert accepts (extra (forward // { port = 443; protocol = "udp"; dest = "10.0.0.2"; }));
"Forward validation: valid inventory and separate protocols accepted; all ${toString (builtins.length invalid)} invalid cases rejected"