depot/third_party/nixpkgs/pkgs/applications/networking/firehol/default.nix

{
  stdenv,
  lib,
  fetchFromGitHub,
  autoconf,
  automake,
  curl,
  iprange,
  iproute2,
  iptables,
  iputils,
  kmod,
  nettools,
  procps,
  tcpdump,
  traceroute,
  util-linux,
  whois,

  # If true, just install FireQOS without FireHOL
  onlyQOS ? false,
}:

stdenv.mkDerivation rec {
  pname = "firehol";
  version = "3.1.7";

  src = fetchFromGitHub {
    owner = "firehol";
    repo = "firehol";
    rev = "v${version}";
    sha256 = "sha256-gq7l7QoUsK+j5DUn84kD9hlUTC4hz3ds3gNJc1tRygs=";
  };

  patches = [
    # configure tries to determine if `ping6` or the newer, combined
    # `ping` is installed by using `ping -6` which would fail.
    ./firehol-ping6.patch

    # put firehol config files in /etc/firehol (not $out/etc/firehol)
    # to avoid error on startup, see #35114
    ./firehol-sysconfdir.patch

    # we must quote "$UNAME_CMD", or the dash in
    # /nix/store/...-coreutils-.../bin/uname will be interpreted as
    # IFS -> error. this might be considered an upstream bug but only
    # appears when there are dashes in the command path
    ./firehol-uname-command.patch
  ];

  nativeBuildInputs = [
    autoconf
    automake
  ];
  buildInputs = [
    curl
    iprange
    iproute2
    iptables
    iputils
    kmod
    nettools
    procps
    tcpdump
    traceroute
    util-linux
    whois
  ];

  preConfigure = "./autogen.sh";
  configureFlags = [
    "--localstatedir=/var"
    "--disable-doc"
    "--disable-man"
    "--disable-update-ipsets"
  ] ++ lib.optionals onlyQOS [ "--disable-firehol" ];

  meta = with lib; {
    description = "Firewall for humans";
    longDescription = ''
      FireHOL, an iptables stateful packet filtering firewall for humans!
      FireQOS, a TC based bandwidth shaper for humans!
    '';
    homepage = "https://firehol.org/";
    license = licenses.gpl2;
    maintainers = with maintainers; [ oxzi ];
    platforms = platforms.linux;
  };
}