4a36e53982
The wg-hive allowedTCPPorts rule gated on deploy.wireguard.enable was a cross-service toggle read in swarm-nats.nix; it now lives in glue-nats-wireguard.nix under the same condition and value.
21 lines
700 B
Nix
21 lines
700 B
Nix
# Glue: where the queue and the wireguard mesh share a host, the queue's port
|
|
# is open on the mesh interface.
|
|
#
|
|
# Interface-scoped, never host-wide: the firewall is default-deny before a
|
|
# packet reaches the listener, so without this no other hive can reach the
|
|
# queue. Gated on BOTH being here — the queue's own module gate
|
|
# (`deploy.nats.enable`) is restated below; a change there must change here.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.nats.enable && deployCfg.wireguard.enable) {
|
|
networking.firewall.interfaces.wg-hive.allowedTCPPorts = [ hyperhiveCfg.swarm.nats.port ];
|
|
};
|
|
}
|