Add firewall config
This commit is contained in:
parent
26cd4f804c
commit
5777182658
GPG key ID:
270B20D17394F7E5
1 changed files with 122 additions and 107 deletions
229
flake.nix
229
flake.nix
|
|
@ -7,119 +7,134 @@
|
|||
};
|
||||
|
||||
outputs = { self, nixpkgs, flake-utils }:
|
||||
flake-utils.lib.eachSystem [ "x86_64-linux" ] (system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
lib = nixpkgs.lib;
|
||||
in
|
||||
{
|
||||
formatter = pkgs.nixpkgs-fmt;
|
||||
packages = {
|
||||
sunshine = pkgs.stdenv.mkDerivation {
|
||||
pname = "sunshine";
|
||||
version = "0.14.1";
|
||||
flake-utils.lib.eachSystem [ "x86_64-linux" ]
|
||||
(system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
lib = nixpkgs.lib;
|
||||
in
|
||||
{
|
||||
formatter = pkgs.nixpkgs-fmt;
|
||||
packages = {
|
||||
sunshine = pkgs.stdenv.mkDerivation {
|
||||
pname = "sunshine";
|
||||
version = "0.14.1";
|
||||
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "LizardByte";
|
||||
repo = "Sunshine";
|
||||
rev = "6000b85b1a4ec574d93fbc7545f5bf48f3d5aaa7";
|
||||
sha256 = "SB2DAOYf2izIwwRWEw2wt5L5oCDbb6YOqXw/z/PD1pQ=";
|
||||
fetchSubmodules = true;
|
||||
};
|
||||
|
||||
buildInputs = with pkgs; [
|
||||
avahi
|
||||
(boost.override { enableStatic = true; })
|
||||
ffmpeg
|
||||
libevdev
|
||||
libpulseaudio
|
||||
xorg.libX11
|
||||
xorg.libxcb
|
||||
xorg.libXfixes
|
||||
xorg.libXrandr
|
||||
xorg.libXtst
|
||||
openssl
|
||||
libopus
|
||||
udev
|
||||
libdrm
|
||||
valgrind.dev
|
||||
wayland
|
||||
libffi
|
||||
icu
|
||||
];
|
||||
|
||||
hardeningDisable = [ "format" ];
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
cmake
|
||||
pkgconf
|
||||
makeWrapper
|
||||
];
|
||||
|
||||
cmakeFlags = [
|
||||
"-DSUNSHINE_ASSETS_DIR=${placeholder "out"}/etc/sunshine"
|
||||
"-DSUNSHINE_CONFIG_DIR=${placeholder "out"}/etc/sunshine"
|
||||
];
|
||||
|
||||
# patches = [ ./001-cmake-find-evdev.patch ];
|
||||
patches = [ ./sunshine.patch ];
|
||||
|
||||
preConfigure = ''
|
||||
substituteInPlace CMakeLists.txt \
|
||||
--replace "/usr/include/libevdev-1.0" "${pkgs.libevdev}/include/libevdev-1.0" \
|
||||
--replace "/etc/udev/rules.d" "$out/etc/udev/rules.d" \
|
||||
--replace "/usr/bin" "$out/bin" \
|
||||
--replace "/usr/lib/systemd/user" "$out/lib/systemd/user"
|
||||
'';
|
||||
|
||||
postInstall = ''
|
||||
wrapProgram $out/bin/sunshine --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath (with pkgs; [ avahi mesa libGL ])}"
|
||||
'';
|
||||
};
|
||||
};
|
||||
packages.default = self.packages.${system}.sunshine;
|
||||
|
||||
devShells.default = with pkgs; mkShell {
|
||||
nativeBuildInputs = [ nix-prefetch-scripts nix-prefetch-github cmake-language-server ];
|
||||
inputsFrom = [ self.packages.${system}.sunshine ];
|
||||
};
|
||||
|
||||
}) // {
|
||||
nixosModule.sunshine = { pkgs, config, lib, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.sunshine;
|
||||
sunshine = self.packages.${pkgs.system}.sunshine;
|
||||
in
|
||||
{
|
||||
options.services.sunshine = {
|
||||
enable = mkEnableOption "sunshine";
|
||||
|
||||
user = mkOption {
|
||||
description = "The user using sunshine";
|
||||
type = types.str;
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "LizardByte";
|
||||
repo = "Sunshine";
|
||||
rev = "6000b85b1a4ec574d93fbc7545f5bf48f3d5aaa7";
|
||||
sha256 = "SB2DAOYf2izIwwRWEw2wt5L5oCDbb6YOqXw/z/PD1pQ=";
|
||||
fetchSubmodules = true;
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
description = "Open the necessary ports for sunshine";
|
||||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
buildInputs = with pkgs; [
|
||||
avahi
|
||||
(boost.override { enableStatic = true; })
|
||||
ffmpeg
|
||||
libevdev
|
||||
libpulseaudio
|
||||
xorg.libX11
|
||||
xorg.libxcb
|
||||
xorg.libXfixes
|
||||
xorg.libXrandr
|
||||
xorg.libXtst
|
||||
openssl
|
||||
libopus
|
||||
udev
|
||||
libdrm
|
||||
valgrind.dev
|
||||
wayland
|
||||
libffi
|
||||
icu
|
||||
];
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [ sunshine ];
|
||||
hardeningDisable = [ "format" ];
|
||||
|
||||
hardware.uinput = true;
|
||||
nativeBuildInputs = with pkgs; [
|
||||
cmake
|
||||
pkgconf
|
||||
makeWrapper
|
||||
];
|
||||
|
||||
users.extraUsers.${cfg.user}.extraGroups = [ "uinput" "video" ];
|
||||
security.wrappers.sunshine = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
capabilities = "cap_sys_admin+p";
|
||||
source = "${sunshine}/bin/sunshine";
|
||||
};
|
||||
cmakeFlags = [
|
||||
"-DSUNSHINE_ASSETS_DIR=${placeholder "out"}/etc/sunshine"
|
||||
"-DSUNSHINE_CONFIG_DIR=${placeholder "out"}/etc/sunshine"
|
||||
];
|
||||
|
||||
# patches = [ ./001-cmake-find-evdev.patch ];
|
||||
patches = [ ./sunshine.patch ];
|
||||
|
||||
preConfigure = ''
|
||||
substituteInPlace CMakeLists.txt \
|
||||
--replace "/usr/include/libevdev-1.0" "${pkgs.libevdev}/include/libevdev-1.0" \
|
||||
--replace "/etc/udev/rules.d" "$out/etc/udev/rules.d" \
|
||||
--replace "/usr/bin" "$out/bin" \
|
||||
--replace "/usr/lib/systemd/user" "$out/lib/systemd/user"
|
||||
'';
|
||||
|
||||
postInstall = ''
|
||||
wrapProgram $out/bin/sunshine --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath (with pkgs; [ avahi mesa libGL ])}"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
packages.default = self.packages.${system}.sunshine;
|
||||
|
||||
devShells.default = with pkgs; mkShell {
|
||||
nativeBuildInputs = [ nix-prefetch-scripts nix-prefetch-github cmake-language-server ];
|
||||
inputsFrom = [ self.packages.${system}.sunshine ];
|
||||
};
|
||||
|
||||
}) // {
|
||||
nixosModule.sunshine = { pkgs, config, lib, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.sunshine;
|
||||
sunshine = self.packages.${pkgs.system}.sunshine;
|
||||
in
|
||||
{
|
||||
options.services.sunshine = {
|
||||
enable = mkEnableOption "sunshine";
|
||||
|
||||
user = mkOption {
|
||||
description = "The user using sunshine";
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
description = "Open the necessary ports for sunshine";
|
||||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [ sunshine ];
|
||||
|
||||
hardware.uinput = true;
|
||||
|
||||
users.extraUsers.${cfg.user}.extraGroups = [ "uinput" "video" ];
|
||||
security.wrappers.sunshine = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
capabilities = "cap_sys_admin+p";
|
||||
source = "${sunshine}/bin/sunshine";
|
||||
};
|
||||
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [
|
||||
48010
|
||||
];
|
||||
|
||||
allowedTCPPortRanges = [
|
||||
{ from = 47984; to = 47990; }
|
||||
];
|
||||
|
||||
allowedUDPPortRanges = [
|
||||
{ from = 47998; to = 48000; }
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue