sshd: provide option to disable firewall altering

NixOS · Jan 18, 2018 · 0a78a38 · 0a78a38
1 parent 3fe396d
commit 0a78a38
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
@@ -136,6 +136,14 @@ in
           Specifies on which ports the SSH daemon listens.
         '';
       };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to automatically open the specified ports in the firewall.
+        '';
+      };
 
       listenAddresses = mkOption {
         type = with types; listOf (submodule {
@@ -302,7 +310,7 @@ in
 
       };
 
-    networking.firewall.allowedTCPPorts = cfg.ports;
+    networking.firewall.allowedTCPPorts = if cfg.openFirewall then cfg.ports else [];
 
     security.pam.services.sshd =
       { startSession = true;