This commit is contained in:
Daniel Flanagan 2024-08-09 16:42:57 -05:00
parent 2a14742b5a
commit 1f793e5296
2 changed files with 201 additions and 53 deletions

View file

@ -167,6 +167,8 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
extraHosts = '' extraHosts = ''
::1 nix.h.lyte.dev ::1 nix.h.lyte.dev
127.0.0.1 nix.h.lyte.dev 127.0.0.1 nix.h.lyte.dev
::1 idm.h.lyte.dev
127.0.0.1 idm.h.lyte.dev
''; '';
}; };
} }
@ -1006,9 +1008,10 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
storage = "/storage/${name}"; storage = "/storage/${name}";
cert = "${storage}/certs/idm.h.lyte.dev.crt"; cert = "${storage}/certs/idm.h.lyte.dev.crt";
key = "${storage}/certs/idm.h.lyte.dev.key"; key = "${storage}/certs/idm.h.lyte.dev.key";
serverSettings = { serverSettings = {
inherit domain; inherit domain;
bindaddress = "localhost:8443"; bindaddress = "127.0.0.1:8443";
# ldapbindaddress # ldapbindaddress
tls_chain = cert; tls_chain = cert;
tls_key = key; tls_key = key;
@ -1021,9 +1024,63 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
# versions = 7; # versions = 7;
}; };
}; };
unixdSettings = {
hsm_pin_path = "/var/cache/${name}-unixd/hsm-pin";
pam_allowed_login_groups = [];
};
clientSettings = {
uri = "https://idm.h.lyte.dev";
};
user = name; user = name;
group = name; group = name;
serverConfigFile = toml.generate "server.toml" serverSettings; serverConfigFile = toml.generate "server.toml" serverSettings;
unixdConfigFile = toml.generate "kanidm-unixd.toml" unixdSettings;
clientConfigFile = toml.generate "kanidm-config.toml" clientSettings;
defaultServiceConfig = {
BindReadOnlyPaths = [
"/nix/store"
"-/etc/resolv.conf"
"-/etc/nsswitch.conf"
"-/etc/hosts"
"-/etc/localtime"
];
CapabilityBoundingSet = [];
# ProtectClock= adds DeviceAllow=char-rtc r
DeviceAllow = "";
# Implies ProtectSystem=strict, which re-mounts all paths
# DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateNetwork = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectHome = true;
ProtectHostname = true;
# Would re-mount paths ignored by temporary root
#ProtectSystem = "strict";
ProtectControlGroups = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service" "~@privileged @resources @setuid @keyring"];
# Does not work well with the temporary root
#UMask = "0066";
};
in { in {
# kanidm # kanidm
@ -1042,9 +1099,8 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
script = '' script = ''
umask 077 umask 077
install -d -m 0700 -o "${user}" -g "${group}" "${storage}/data" "${storage}/certs" install -d -m 0700 -o "${user}" -g "${group}" "${storage}/data" "${storage}/certs"
rsync --no-perms --no-owner --no-group /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev/idm.h.lyte.dev.crt "${cert}" cd /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev
rsync --no-perms --no-owner --no-group /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/idm.h.lyte.dev/idm.h.lyte.dev.key "${key}" install -m 0700 -o "${user}" -g "${group}" idm.h.lyte.dev.key idm.h.lyte.dev.crt "${storage}/certs"
chown "${user}:${group}" "${cert}" "${key}"
''; '';
path = with pkgs; [rsync]; path = with pkgs; [rsync];
serviceConfig = { serviceConfig = {
@ -1061,6 +1117,11 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
inherit user group; inherit user group;
mode = "0700"; mode = "0700";
}; };
# "${builtins.dirOf unixdSettings.hsm_pin_path}".d = {
# user = "${user}-unixd";
# group = "${group}-unixd";
# mode = "0700";
# };
"${storage}/data".d = { "${storage}/data".d = {
inherit user group; inherit user group;
mode = "0700"; mode = "0700";
@ -1073,6 +1134,7 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
users.groups = { users.groups = {
${group} = {}; ${group} = {};
"${group}-unixd" = {};
}; };
users.users.${user} = { users.users.${user} = {
@ -1081,22 +1143,34 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
isSystemUser = true; isSystemUser = true;
packages = [package]; packages = [package];
}; };
users.users."${user}-unixd" = {
group = "${group}-unixd";
description = "kanidm PAM daemon";
isSystemUser = true;
};
# the kanidm module in nixpkgs was not working for me, so I rolled my own # the kanidm module in nixpkgs was not working for me, so I rolled my own
# loosely based off it # loosely based off it
systemd.services.kanidm = { systemd.services.kanidm = {
enable = true; enable = true;
path = with pkgs; [openssl]; path = with pkgs; [openssl] ++ [package];
description = "kanidm identity management daemon"; description = "kanidm identity management daemon";
wantedBy = ["multi-user.target"]; wantedBy = ["multi-user.target"];
after = ["network.target"]; after = ["network.target"];
requires = ["copy-kanidm-certificates-from-caddy.service"]; requires = ["copy-kanidm-certificates-from-caddy.service"];
script = ''
pwd
ls -la
ls -laR /storage/kanidm
${package}/bin/kanidmd server -c ${serverConfigFile}
'';
# environment.RUST_LOG = serverSettings.log_level; # environment.RUST_LOG = serverSettings.log_level;
serviceConfig = { serviceConfig = lib.mkMerge [
defaultServiceConfig
{
StateDirectory = name; StateDirectory = name;
StateDirectoryMode = "0700"; StateDirectoryMode = "0700";
RuntimeDirectory = "${name}d"; RuntimeDirectory = "${name}d";
ExecStart = "bash -c 'pwd; ls -la; ls -laR /storage/kanidm; ${package}/bin/kanidmd server -c ${serverConfigFile}'";
User = user; User = user;
Group = group; Group = group;
@ -1106,43 +1180,110 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
PrivateNetwork = lib.mkForce false; PrivateNetwork = lib.mkForce false;
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"]; RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
# TemporaryFileSystem = "/:ro"; # TemporaryFileSystem = "/:ro";
BindReadOnlyPaths = [
"${storage}/certs"
];
BindPaths = [
"${storage}/data"
DeviceAllow = ""; # socket
LockPersonality = true; "/run/${name}d:/run/${name}d"
ProtectControlGroups = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service" "~@privileged @resources @setuid @keyring"];
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
# PrivateDevices = true;
# PrivateMounts = true;
# PrivateTmp = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectHome = true;
ProtectHostname = true;
# BindReadOnlyPaths = [
# "${storage}/certs"
# ];
# BindPaths = [
# "${storage}/data"
# # socket # backups
# "/run/${name}d:/run/${name}d" serverSettings.online_backup.path
];
# # backups }
# serverSettings.online_backup.path ];
# ];
}; };
systemd.services.kanidm-unixd = {
description = "Kanidm PAM daemon";
wantedBy = ["multi-user.target"];
after = ["network.target"];
restartTriggers = [unixdConfigFile clientConfigFile];
serviceConfig = lib.mkMerge [
defaultServiceConfig
{
CacheDirectory = "${name}-unixd";
CacheDirectoryMode = "0700";
RuntimeDirectory = "${name}-unixd";
ExecStart = "${package}/bin/kanidm_unixd";
User = "${user}-unixd";
Group = "${group}-unixd";
BindReadOnlyPaths = [
"-/etc/kanidm"
"-/etc/static/kanidm"
"-/etc/ssl"
"-/etc/static/ssl"
"-/etc/passwd"
"-/etc/group"
];
BindPaths = [
# socket
"/run/kanidm-unixd:/var/run/kanidm-unixd"
];
# Needs to connect to kanidmd
PrivateNetwork = lib.mkForce false;
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
TemporaryFileSystem = "/:ro";
}
];
environment.RUST_LOG = serverSettings.log_level;
}; };
systemd.services.kanidm-unixd-tasks = {
description = "Kanidm PAM home management daemon";
wantedBy = ["multi-user.target"];
after = ["network.target" "kanidm-unixd.service"];
partOf = ["kanidm-unixd.service"];
restartTriggers = [unixdConfigFile clientConfigFile];
serviceConfig = {
ExecStart = "${package}/bin/kanidm_unixd_tasks";
BindReadOnlyPaths = [
"/nix/store"
"-/etc/resolv.conf"
"-/etc/nsswitch.conf"
"-/etc/hosts"
"-/etc/localtime"
"-/etc/kanidm"
"-/etc/static/kanidm"
];
BindPaths = [
# To manage home directories
"/home"
# To connect to kanidm-unixd
"/run/kanidm-unixd:/var/run/kanidm-unixd"
];
# CAP_DAC_OVERRIDE is needed to ignore ownership of unixd socket
CapabilityBoundingSet = ["CAP_CHOWN" "CAP_FOWNER" "CAP_DAC_OVERRIDE" "CAP_DAC_READ_SEARCH"];
IPAddressDeny = "any";
# Need access to users
PrivateUsers = false;
# Need access to home directories
ProtectHome = false;
RestrictAddressFamilies = ["AF_UNIX"];
TemporaryFileSystem = "/:ro";
Restart = "on-failure";
};
environment.RUST_LOG = serverSettings.log_level;
};
environment.etc = {
"kanidm/server.toml".source = serverConfigFile;
"kanidm/config".source = clientConfigFile;
"kanidm/unixd".source = unixdConfigFile;
};
system.nssModules = [package];
system.nssDatabases.group = [name];
system.nssDatabases.passwd = [name];
# environment.etc."kanidm/server.toml" = { # environment.etc."kanidm/server.toml" = {
# mode = "0600"; # mode = "0600";
# group = "kanidm"; # group = "kanidm";
@ -1156,7 +1297,14 @@ sudo nix run nixpkgs#ipmitool -- raw 0x30 0x30 0x02 0xff 0x00
# }; # };
services.caddy.virtualHosts."idm.h.lyte.dev" = { services.caddy.virtualHosts."idm.h.lyte.dev" = {
extraConfig = ''reverse_proxy :8443''; extraConfig = ''reverse_proxy https://idm.h.lyte.dev:8443'';
};
networking = {
extraHosts = ''
::1 idm.h.lyte.dev
127.0.0.1 idm.h.lyte.dev
'';
}; };
}; };
}) })

View file

@ -31,7 +31,7 @@
hardware.bluetooth = { hardware.bluetooth = {
enable = true; enable = true;
package = pkgs.bluez; # package = pkgs.bluez;
settings = { settings = {
General = { General = {
AutoConnect = true; AutoConnect = true;