runs-on: docker

Reviewed-on: Fediversity/Fediversity#420
Reviewed-by: Valentin Gagarin <valentin.gagarin@tweag.io>
Co-authored-by: Nicolas “Niols” Jeannerod <nicolas.jeannerod@moduscreate.com>
Co-committed-by: Nicolas “Niols” Jeannerod <nicolas.jeannerod@moduscreate.com>

default.nix

@@ -58,6 +58,11 @@ in
       in
       [
         pkgs.npins
+        pkgs.nil
+        (pkgs.callPackage "${sources.agenix}/pkgs/agenix.nix" { })
+        pkgs.openssh
+        pkgs.httpie
+        pkgs.jq
         pkgs.nix-unit
         test-loop
         nixops4.packages.${system}.default

flake.nix

@@ -11,7 +11,7 @@
     let
       sources = import ./npins;
       inherit (import sources.flake-inputs) import-flake;
-      inherit (sources) git-hooks agenix;
+      inherit (sources) git-hooks;
       # XXX(@fricklerhandwerk): this atrocity is required to splice in a foreign Nixpkgs via flake-parts
       # XXX - this is just importing a flake
       nixpkgs = import-flake { src = sources.nixpkgs; };
@@ -54,7 +54,6 @@
             {
               pkgs,
               lib,
-              inputs',
               ...
             }:
             {
@@ -73,21 +72,6 @@
                   trim-trailing-whitespace.enable = true;
                   shellcheck.enable = true;
                 };
-
-              devShells.default = pkgs.mkShell {
-                packages = [
-                  pkgs.npins
-                  pkgs.nil
-                  (pkgs.callPackage "${agenix}/pkgs/agenix.nix" { })
-                  pkgs.openssh
-                  pkgs.httpie
-                  pkgs.jq
-                  # exposing this env var as a hack to pass info in from form
-                  (inputs'.nixops4.packages.default.overrideAttrs {
-                    impureEnvVars = [ "DEPLOYMENT" ];
-                  })
-                ];
-              };
             };
         }
       );

infra/common/nixos/networking.nix

@@ -21,13 +21,8 @@ in
         ## REVIEW: Do we actually need that, considering that we have static IPs?
         useDHCP = mkDefault true;
 
-        nameservers = [
+        ## Disable the default firewall and use nftables instead, with a custom
-          "95.215.185.6"
+        ## Procolix-made ruleset.
-          "95.215.185.7"
-          "2a00:51c0::5fd7:b906"
-          "2a00:51c0::5fd7:b907"
-        ];
-
         firewall.enable = false;
         nftables = {
           enable = true;
@@ -44,6 +39,10 @@ in
           address = config.fediversityVm.ipv4.gateway;
           interface = config.fediversityVm.ipv4.interface;
         };
+        nameservers = [
+          "95.215.185.6"
+          "95.215.185.7"
+        ];
       })
 
       ## IPv6
@@ -55,6 +54,10 @@ in
           address = config.fediversityVm.ipv6.gateway;
           interface = config.fediversityVm.ipv6.interface;
         };
+        nameservers = [
+          "2a00:51c0::5fd7:b906"
+          "2a00:51c0::5fd7:b907"
+        ];
       })
     ];
   };