nixos/firewall: disable refused connections logging (#507761)

2026-04-13 15:09:14 +00:00
parent 51ef7145b6 760f43a69e
commit 70c6c288be
2 changed files with 7 additions and 1 deletions
@@ -361,6 +361,12 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.

+- The `networking.firewall.logRefusedConnections` option now defaults to
+  `false`.  Logging of refused or dropped incoming connections can generate a
+  very high volume of kernel log messages on internet-facing systems, causing
+  the kernel ring buffer (dmesg) to rotate quickly and potentially discard more
+  relevant diagnostic information.
+
 - The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions.

 - `services.kanidm` options for server, client and unix were moved under dedicated namespaces.
@@ -118,7 +118,7 @@ in

      logRefusedConnections = lib.mkOption {
        type = lib.types.bool;
-        default = true;
+        default = false;
        description = ''
          Whether to log rejected or dropped incoming connections.
          Note: The logs are found in the kernel logs, i.e. dmesg