From dc49e8c9c5c3a2907cd00a784b802633d8524396 Mon Sep 17 00:00:00 2001 From: "git@71rd.net" Date: Sun, 25 Jan 2026 21:10:40 +0000 Subject: [PATCH] nixos/nftables: replace script with file nftables service successfully restarts or reloads if the file `/var/lib/nftables/deletions.nft` is on a partition that was mounted as noexec, and delete previous rules. Instead of writing a deletion script, the service creates a simple file where nftables rules are written to that is used as an argument for the `nft` command to delete rules upon stop,restart, or reload. --- nixos/modules/services/networking/nftables.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix index 7275d25ad5e1..40718c879ccf 100644 --- a/nixos/modules/services/networking/nftables.nix +++ b/nixos/modules/services/networking/nftables.nix @@ -298,7 +298,6 @@ in let enabledTables = lib.filterAttrs (_: table: table.enable) cfg.tables; deletionsScript = pkgs.writeScript "nftables-deletions" '' - #! ${pkgs.nftables}/bin/nft -f ${ if cfg.flushRuleset then "flush ruleset" @@ -313,9 +312,9 @@ in ${cfg.extraDeletions} ''; deletionsScriptVar = "/var/lib/nftables/deletions.nft"; + makeDeletions = "${pkgs.nftables}/bin/nft -f ${deletionsScriptVar}"; ensureDeletions = pkgs.writeShellScript "nftables-ensure-deletions" '' touch ${deletionsScriptVar} - chmod +x ${deletionsScriptVar} ''; saveDeletionsScript = pkgs.writeShellScript "nftables-save-deletions" '' cp ${deletionsScript} ${deletionsScriptVar} @@ -380,7 +379,7 @@ in saveDeletionsScript ]; ExecStop = [ - deletionsScriptVar + makeDeletions cleanupDeletionsScript ]; StateDirectory = "nftables";