improve allow-peer sg to only allows relays that actually connect

input-output-hk · Jul 31, 2020 · dbc8296 · dbc8296
1 parent e6e87b0
commit dbc8296
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/physical/aws/security-groups/allow-peers.nix b/physical/aws/security-groups/allow-peers.nix
@@ -3,9 +3,11 @@ with lib;
 let
   inherit (pkgs.globals) cardanoNodePort topology maxPrivilegedRelays;
   inherit (topology) coreNodes relayNodes byronProxies;
+  concernedCoreNodes = map (c: c.name) (filter (c: c.region == region && c.org == org) coreNodes);
   privateRelayNodes = topology.privateRelayNodes or [];
-  privilegedRelays = lib.take maxPrivilegedRelays relayNodes;
-  peers = map (n: n.name) (builtins.concatLists [ coreNodes privateRelayNodes privilegedRelays byronProxies ])
+  concernedRelays = filter (r: any (p: builtins.elem p concernedCoreNodes) r.producers) (privateRelayNodes ++ relayNodes);
+  privilegedRelays = lib.take maxPrivilegedRelays concernedRelays;
+  peers = map (n: n.name) (builtins.concatLists [ coreNodes privilegedRelays byronProxies ])
     # Allow explorer to connect directly to core nodes if there is no relay nodes.
     ++ (lib.optional (nodes ? explorer && relayNodes == []) "explorer");
 in