fix: immich firewall

config/services/idmail.nix

@@ -2,6 +2,7 @@
   inputs,
   config,
   globals,
+  pkgs,
   ...
 }:
 let
@@ -42,7 +43,7 @@ in
   };
 
   services.idmail = {
-    package = inputs.idmail.packages."aarch64-linux".default;
+    package = inputs.idmail.packages.${pkgs.system}.default;
     enable = true;
     # Stalwart will change permissions due to SQLite implementation.
     # Therefore, run as stalwart-mail since we don't allow reading

config/services/immich.nix

@@ -252,7 +252,7 @@ in
     after = [ "conntrack" ];
     rules = [
       "iifname services ip saddr ${nodes.nucnix-nginx.config.wireguard.services.ipv4} tcp dport 2283 accept"
-      "iifname podman1 oifname lan accept"
+      "iifname podman1 oifname lan-services accept"
     ];
   };
   systemd.tmpfiles.settings = {

flake.nix

@@ -4,6 +4,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixp-meta.url = "git+https://forge.lel.lol/patrick/nixp-meta.git";
+    mdns.url = "git+https://forge.lel.lol/patrick/mdns-repeater.git";
     idmail = {
       url = "github:oddlama/idmail/";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/nucnix/forwarding.nix

@@ -82,26 +82,4 @@ mkMerge [
     ];
     protocol = "udp";
   })
-  {
-    networking.nftables.ruleset = ''
-      table ip mdns {
-        chain prerouting {
-            type filter hook prerouting priority mangle; policy accept;
-
-            iifname {lan-home, lan-services} ip daddr 224.0.0.251 meta mark 0xa5f3 jump mdns-saddr
-            iifname {lan-home, lan-services} ip daddr 224.0.0.251 meta mark != 0xa5f3 jump mdns
-        }
-        chain mdns {
-            meta mark set 0xa5f3
-            iifname lan-services dup to 224.0.0.251 device lan-home
-            iifname lan-home dup to 224.0.0.251 device lan-services
-        }
-        chain mdns-saddr {
-            # repeat mDNS from IoT to main
-            iifname lan-services ip saddr set 10.99.20.1
-            iifname lan-home ip saddr set 10.99.10.1
-        }
-      }
-    '';
-  }
 ]

hosts/nucnix/mdns.nix

@@ -0,0 +1,75 @@
+{
+  inputs,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = {
+    interfaces = "lan-.*";
+    rules = [
+      {
+        from = "lan-home";
+        to = "lan-services";
+        allow_questions = "(nucnix|elisabeth)";
+        allow_answers = "";
+      }
+      {
+        from = "lan-services";
+        to = "lan-home";
+        allow_questions = "";
+        allow_answers = "(nucnix|elisabeth)";
+      }
+    ];
+  };
+in
+{
+  systemd.services.mdns-relay = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+
+    #environment.RUST_LOG = "debug";
+
+    serviceConfig = {
+      Restart = "on-failure";
+      ExecStart = "${
+        lib.getExe inputs.mdns.packages.${pkgs.system}.default
+      } -c ${pkgs.writeText "config.json" (builtins.toJSON cfg)}";
+
+      # Hardening
+      DynamicUser = true;
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateUsers = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_NETLINK"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+      UMask = "0027";
+    };
+  };
+}

hosts/nucnix/net.nix

@@ -18,6 +18,7 @@ in
   imports = [
     ./kea.nix
     ./forwarding.nix
+    ./mdns.nix
   ];
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
   networking.nftables.firewall.zones = mkMerge [