From 20e0a7e0b1006b78fc43b57678c790d6087e55f6 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 24 Dec 2021 00:48:23 +0100 Subject: tv charybdis: add group --- tv/3modules/charybdis/default.nix | 3 +++ 1 file changed, 3 insertions(+) (limited to 'tv/3modules') diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix index 9c5ce2731..1917ab75d 100644 --- a/tv/3modules/charybdis/default.nix +++ b/tv/3modules/charybdis/default.nix @@ -84,7 +84,10 @@ in { users.users.${cfg.user.name} = { inherit (cfg.user) home name uid; createHome = true; + group = cfg.user.name; isSystemUser = true; }; + + users.groups.${cfg.user.name} = {}; }; } -- cgit v1.2.3 From f7ab46c2ec77fc87a9d564306c867d79ba6ab070 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 24 Dec 2021 00:48:38 +0100 Subject: tv ejabberd: add group --- tv/3modules/ejabberd/default.nix | 3 +++ 1 file changed, 3 insertions(+) (limited to 'tv/3modules') diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 2ca88732b..20b79f07f 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -119,7 +119,10 @@ in { users.users.${cfg.user.name} = { inherit (cfg.user) home name uid; createHome = true; + group = cfg.user.name; isSystemUser = true; }; + + users.groups.${cfg.user.name} = {}; }; } -- cgit v1.2.3 From 8ee6e71092d3da2da372f0827b0a7fe27e6797cd Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 25 Dec 2021 11:41:06 +0100 Subject: tv x0vncserver: use LoadCredential --- tv/3modules/x0vncserver.nix | 28 +++++++--------------------- 1 file changed, 7 insertions(+), 21 deletions(-) (limited to 'tv/3modules') diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix index ba79c4a49..4dbb34df0 100644 --- a/tv/3modules/x0vncserver.nix +++ b/tv/3modules/x0vncserver.nix @@ -11,17 +11,12 @@ in { }; enable = mkEnableOption "tv.x0vncserver"; pwfile = mkOption { - default = { - name = "x0vncserver-pwfile"; - owner = cfg.user; - path = "${cfg.user.home}/.vncpasswd"; - source-path = toString + "/vncpasswd"; - }; + default = toString + "/vncpasswd"; description = '' Use vncpasswd to edit pwfile. See: nix-shell -p tigervnc --run 'man vncpasswd' ''; - type = types.secret-file; + type = types.absolute-pathname; }; rfbport = mkOption { default = 5900; @@ -33,26 +28,17 @@ in { }; }; config = mkIf cfg.enable { - krebs.secret.files = { - x0vncserver-pwfile = cfg.pwfile; - }; + krebs.systemd.services.x0vncserver = {}; systemd.services.x0vncserver = { - after = [ - config.krebs.secret.files.x0vncserver-pwfile.service - "graphical.target" - ]; - partOf = [ - config.krebs.secret.files.x0vncserver-pwfile.service - ]; - requires = [ - "graphical.target" - ]; + after = [ "graphical.target" ]; + requires = [ "graphical.target" ]; serviceConfig = { ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [ "-display ${cfg.display}" - "-passwordfile ${cfg.pwfile.path}" + "-passwordfile \${CREDENTIALS_DIRECTORY}/pwfile" "-rfbport ${toString cfg.rfbport}" ]}"; + LoadCredential = "ssh_key:${cfg.pwfile}"; User = cfg.user.name; }; }; -- cgit v1.2.3 From d4b12744d5dab07f3dc60182a86e32f775d3fe4b Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 25 Dec 2021 11:41:15 +0100 Subject: tv charybdis: use LoadCredential --- tv/3modules/charybdis/config.nix | 4 ++-- tv/3modules/charybdis/default.nix | 43 ++++++++++++++------------------------- 2 files changed, 17 insertions(+), 30 deletions(-) (limited to 'tv/3modules') diff --git a/tv/3modules/charybdis/config.nix b/tv/3modules/charybdis/config.nix index 3c73d2565..dccbfde67 100644 --- a/tv/3modules/charybdis/config.nix +++ b/tv/3modules/charybdis/config.nix @@ -61,13 +61,13 @@ in toFile "charybdis.conf" '' vhost6 = ${toJSON config.krebs.build.host.nets.retiolum.ip6.addr}; /* ssl_private_key: our ssl private key */ - ssl_private_key = ${toJSON cfg.ssl_private_key.path}; + ssl_private_key = "/tmp/credentials/ssl_private_key"; /* ssl_cert: certificate for our ssl server */ ssl_cert = ${toJSON cfg.ssl_cert}; /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */ - ssl_dh_params = ${toJSON cfg.ssl_dh_params.path}; + ssl_dh_params = "/tmp/credentials/ssl_dh_params"; /* ssld_count: number of ssld processes you want to start, if you * have a really busy server, using N-1 where N is the number of diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix index 1917ab75d..96aae702a 100644 --- a/tv/3modules/charybdis/default.nix +++ b/tv/3modules/charybdis/default.nix @@ -15,22 +15,12 @@ in { type = types.path; }; ssl_dh_params = mkOption { - type = types.secret-file; - default = { - name = "charybdis-ssl_dh_params"; - path = "${cfg.user.home}/dh.pem"; - owner = cfg.user; - source-path = toString + "/charybdis.dh.pem"; - }; + type = types.absolute-pathname; + default = toString + "/charybdis.dh.pem"; }; ssl_private_key = mkOption { - type = types.secret-file; - default = { - name = "charybdis-ssl_private_key"; - path = "${cfg.user.home}/ssl.key.pem"; - owner = cfg.user; - source-path = toString + "/charybdis.key.pem"; - }; + type = types.absolute-pathname; + default = toString + "/charybdis.key.pem"; }; sslport = mkOption { type = types.int; @@ -46,22 +36,13 @@ in { }; config = lib.mkIf cfg.enable { - krebs.secret.files.charybdis-ssl_dh_params = cfg.ssl_dh_params; - krebs.secret.files.charybdis-ssl_private_key = cfg.ssl_private_key; - environment.etc."charybdis-ircd.motd".text = cfg.motd; + krebs.systemd.services.charybdis = {}; + systemd.services.charybdis = { wantedBy = [ "multi-user.target" ]; - after = [ - config.krebs.secret.files.charybdis-ssl_dh_params.service - config.krebs.secret.files.charybdis-ssl_private_key.service - "network-online.target" - ]; - partOf = [ - config.krebs.secret.files.charybdis-ssl_dh_params.service - config.krebs.secret.files.charybdis-ssl_private_key.service - ]; + after = [ "network-online.target" ]; environment = { BANDB_DBPATH = "${cfg.user.home}/ban.db"; }; @@ -70,14 +51,20 @@ in { User = cfg.user.name; PrivateTmp = true; Restart = "always"; - ExecStartPre = - "${pkgs.coreutils}/bin/ln -s /etc/charybdis-ircd.motd /tmp/ircd.motd"; + ExecStartPre = [ + "${pkgs.coreutils}/bin/ln -s /etc/charybdis-ircd.motd /tmp/ircd.motd" + "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials" + ]; ExecStart = toString [ "${pkgs.charybdis}/bin/charybdis" "-configfile ${import ./config.nix args}" "-foreground" "-logfile /dev/stderr" ]; + LoadCredential = [ + "ssl_dh_params:${cfg.ssl_dh_params}" + "ssl_private_key:${cfg.ssl_private_key}" + ]; }; }; -- cgit v1.2.3 From a1a0f11af481d94fea38f0f6f71e3340587503ac Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 25 Dec 2021 11:41:20 +0100 Subject: tv ejabberd: use LoadCredential --- tv/3modules/ejabberd/config.nix | 9 ++++---- tv/3modules/ejabberd/default.nix | 49 ++++++++++++---------------------------- 2 files changed, 19 insertions(+), 39 deletions(-) (limited to 'tv/3modules') diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix index a0631e226..a022bc448 100644 --- a/tv/3modules/ejabberd/config.nix +++ b/tv/3modules/ejabberd/config.nix @@ -48,6 +48,9 @@ in /* yaml */ '' - "::1/128" - "::FFFF:127.0.0.1/128" + certfiles: + - /tmp/credentials/certfile + hosts: ${toJSON config.hosts} language: "en" @@ -58,9 +61,8 @@ in /* yaml */ '' ip: "::" module: ejabberd_c2s shaper: c2s_shaper - certfile: ${toJSON config.certfile.path} ciphers: ${toJSON ciphers} - dhfile: ${toJSON config.dhfile.path} + dhfile: /var/lib/ejabberd/dhfile protocol_options: ${toJSON protocol_options} starttls: true starttls_required: true @@ -109,9 +111,8 @@ in /* yaml */ '' mod_http_api: {} s2s_access: s2s - s2s_certfile: ${toJSON config.s2s_certfile.path} s2s_ciphers: ${toJSON ciphers} - s2s_dhfile: ${toJSON config.dhfile.path} + s2s_dhfile: /var/lib/ejabberd/dhfile s2s_protocol_options: ${toJSON protocol_options} s2s_tls_compression: false s2s_use_starttls: required diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 20b79f07f..935df9a9c 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -16,22 +16,8 @@ in { options.tv.ejabberd = { enable = mkEnableOption "tv.ejabberd"; certfile = mkOption { - type = types.secret-file; - default = { - name = "ejabberd-certfile"; - path = "${cfg.user.home}/ejabberd.pem"; - owner = cfg.user; - source-path = toString + "/ejabberd.pem"; - }; - }; - dhfile = mkOption { - type = types.secret-file; - default = { - name = "ejabberd-dhfile"; - path = "${cfg.user.home}/dhparams.pem"; - owner = cfg.user; - source-path = "/dev/null"; - }; + type = types.absolute-pathname; + default = toString + "/ejabberd.pem"; }; hosts = mkOption { type = with types; listOf str; @@ -61,10 +47,6 @@ in { config.krebs.users.tv.mail ]; }; - s2s_certfile = mkOption { - type = types.secret-file; - default = cfg.certfile; - }; user = mkOption { type = types.user; default = { @@ -90,27 +72,24 @@ in { }) ]; - krebs.secret.files = { - ejabberd-certfile = cfg.certfile; - ejabberd-s2s_certfile = cfg.s2s_certfile; - }; + krebs.systemd.services.ejabberd = {}; systemd.services.ejabberd = { wantedBy = [ "multi-user.target" ]; - after = [ - config.krebs.secret.files.ejabberd-certfile.service - config.krebs.secret.files.ejabberd-s2s_certfile.service - "network.target" - ]; - partOf = [ - config.krebs.secret.files.ejabberd-certfile.service - config.krebs.secret.files.ejabberd-s2s_certfile.service - ]; + after = [ "network.target" ]; serviceConfig = { - ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}"; - ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; + ExecStart = pkgs.writeDash "ejabberd" '' + ${pkgs.coreutils}/bin/ln -s "$CREDENTIALS_DIRECTORY" /tmp/credentials + ${gen-dhparam} /var/lib/ejabberd/dhfile + exec ${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground + ''; + LoadCredential = [ + "certfile:${cfg.certfile}" + ]; PermissionsStartOnly = true; + PrivateTmp = true; SyslogIdentifier = "ejabberd"; + StateDirectory = "ejabberd"; User = cfg.user.name; TimeoutStartSec = 60; }; -- cgit v1.2.3