145 lines
4 KiB
Nix
145 lines
4 KiB
Nix
{
|
|
config,
|
|
nodes,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
prestart = pkgs.writeShellScript "pr-tracker-pre" ''
|
|
if [ ! -d ./nixpkgs ]; then
|
|
${lib.getExe pkgs.git} clone https://github.com/NixOS/nixpkgs.git
|
|
fi
|
|
'';
|
|
in
|
|
{
|
|
wireguard.elisabeth = {
|
|
client.via = "elisabeth";
|
|
firewallRuleForNode.elisabeth.allowedTCPPorts = [ 3000 ];
|
|
};
|
|
networking.firewall.allowedTCPPorts = [ 3000 ];
|
|
environment.persistence."/persist".directories = [
|
|
{
|
|
directory = "/var/lib/pr-tracker";
|
|
user = "pr-tracker";
|
|
group = "pr-tracker";
|
|
mode = "0700";
|
|
}
|
|
];
|
|
age.secrets.maddyPasswd = {
|
|
generator.script = "alnum";
|
|
owner = "pr-tracker";
|
|
};
|
|
age.secrets.prTrackerEnv = {
|
|
rekeyFile = config.node.secretsDir + "/env.age";
|
|
owner = "pr-tracker";
|
|
};
|
|
age.secrets.prTrackerWhiteList = {
|
|
rekeyFile = config.node.secretsDir + "/white-list.age";
|
|
owner = "pr-tracker";
|
|
};
|
|
nodes.maddy = {
|
|
age.secrets.pr-trackerPasswd = {
|
|
inherit (config.age.secrets.maddyPasswd) rekeyFile;
|
|
inherit (nodes.maddy.config.services.maddy) group;
|
|
mode = "640";
|
|
};
|
|
services.maddy.ensureCredentials = {
|
|
"pr-tracker@${config.secrets.secrets.global.domains.mail_public}".passwordFile =
|
|
nodes.maddy.config.age.secrets.pr-trackerPasswd.path;
|
|
};
|
|
};
|
|
systemd.sockets.pr-tracker = {
|
|
listenStreams = [ "0.0.0.0:3000" ];
|
|
wantedBy = [ "sockets.target" ];
|
|
};
|
|
systemd.services.pr-tracker = {
|
|
path = [ pkgs.git ];
|
|
serviceConfig = {
|
|
User = "pr-tracker";
|
|
Group = "pr-tracker";
|
|
StateDirectory = "pr-tracker";
|
|
WorkingDirectory = "/var/lib/pr-tracker";
|
|
LimitNOFILE = "1048576";
|
|
PrivateTmp = true;
|
|
PrivateDevices = true;
|
|
StateDirectoryMode = "0700";
|
|
Restart = "always";
|
|
ExecStartPre = prestart;
|
|
ExecStart = ''
|
|
${lib.getExe pkgs.pr-tracker} --url "https://pr-tracker.${config.secrets.secrets.global.domains.web}"\
|
|
--user-agent "Patricks pr-tracker" \
|
|
--path nixpkgs --remote origin \
|
|
--email-white-list ${config.age.secrets.prTrackerWhiteList.path} \
|
|
--email-address pr-tracker@${config.secrets.secrets.global.domains.mail_public} \
|
|
--email-server smtp.${config.secrets.secrets.global.domains.mail_public} \
|
|
'';
|
|
EnvironmentFile = config.age.secrets.prTrackerEnv.path;
|
|
|
|
# Hardening
|
|
CapabilityBoundingSet = "";
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
PrivateUsers = true;
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "invisible";
|
|
ProcSubset = "pid";
|
|
ProtectSystem = "strict";
|
|
RestrictAddressFamilies = [
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
"AF_NETLINK"
|
|
];
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = [
|
|
"@system-service"
|
|
"@pkey"
|
|
];
|
|
UMask = "0077";
|
|
};
|
|
};
|
|
systemd.timers.pr-tracker-update = {
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "30m";
|
|
OnUnitActiveSec = "30m";
|
|
};
|
|
};
|
|
users.groups.pr-tracker = { };
|
|
users.users.pr-tracker = {
|
|
isSystemUser = true;
|
|
group = "pr-tracker";
|
|
home = "/var/lib/pr-tracker";
|
|
};
|
|
|
|
systemd.services.pr-tracker-update = {
|
|
script = ''
|
|
set -eu
|
|
${lib.getExe pkgs.git} -C nixpkgs fetch
|
|
${lib.getExe pkgs.curl} http://localhost:3000/update
|
|
'';
|
|
serviceConfig = {
|
|
Requires = "pr-tracker";
|
|
Type = "oneshot";
|
|
User = "pr-tracker";
|
|
Group = "pr-tracker";
|
|
StateDirectory = "pr-tracker";
|
|
WorkingDirectory = "/var/lib/pr-tracker";
|
|
LimitNOFILE = "1048576";
|
|
PrivateTmp = true;
|
|
PrivateDevices = true;
|
|
StateDirectoryMode = "0700";
|
|
ExecStartPre = prestart;
|
|
EnvironmentFile = config.age.secrets.prTrackerEnv.path;
|
|
};
|
|
};
|
|
}
|