
# Nebula security group configuration
firewall:
  # Action to take when a packet is not allowed by the firewall rules.
  # Can be one of:
  #   `drop` (default): silently drop the packet.
  #   `reject`: send a reject reply.
  #     - For TCP, this will be a RST "Connection Reset" packet.
  #     - For other protocols, this will be an ICMP port unreachable packet.
  outbound_action: reject
  inbound_action: reject

  # Controls the default value for local_cidr. Default is true, will be deprecated after v1.9 and defaulted to false.
  # This setting only affects nebula hosts with subnets encoded in their certificate. A nebula host acting as an
  # unsafe router with `default_local_cidr_any: true` will expose their unsafe routes to every inbound rule regardless
  # of the actual destination for the packet. Setting this to false requires each inbound rule to contain a `local_cidr`
  # if the intention is to allow traffic to flow to an unsafe route.
  default_local_cidr_any: false

  conntrack:
    tcp_timeout: 12m
    udp_timeout: 3m
    default_timeout: 10m

  outbound:
{% for rule in outbound_rules %}
    - port: {{ rule.port }}
      proto: {{ rule.proto }}
{% if rule.host is defined %}
      host: {{ rule.host }}
{% endif %}
{% if rule.group is defined %}
      group: {{ rule.group }}
{% endif %}
{% endfor %}

  inbound:
{% for rule in inbound_rules %}
    - port: {{ rule.port }}
      proto: {{ rule.proto }}
{% if rule.host is defined %}
      host: {{ rule.host }}
{% endif %}
{% if rule.group is defined %}
      group: {{ rule.group }}
{% endif %}
{% endfor %}
