| + |
{ config, lib, pkgs, ... }:
|
| + |
let
|
| + |
cfg = config.services.radicle;
|
| + |
|
| + |
json = pkgs.formats.json { };
|
| + |
|
| + |
env = rec {
|
| + |
# rad fails if it cannot stat $HOME/.gitconfig
|
| + |
HOME = "/var/lib/radicle";
|
| + |
RAD_HOME = HOME;
|
| + |
};
|
| + |
|
| + |
# Convenient wrapper to run `rad` in the namespaces of `radicle-node.service`
|
| + |
rad-system = pkgs.writeShellScriptBin "rad-system" ''
|
| + |
set -o allexport
|
| + |
${lib.toShellVars env}
|
| + |
# Note that --env is not used to preserve host's envvars like $TERM
|
| + |
exec ${lib.getExe' pkgs.util-linux "nsenter"} -a \
|
| + |
-t "$(${lib.getExe' config.systemd.package "systemctl"} show -P MainPID radicle-node.service)" \
|
| + |
-S "$(${lib.getExe' config.systemd.package "systemctl"} show -P UID radicle-node.service)" \
|
| + |
-G "$(${lib.getExe' config.systemd.package "systemctl"} show -P GID radicle-node.service)" \
|
| + |
${lib.getExe' cfg.package "rad"} "$@"
|
| + |
'';
|
| + |
|
| + |
commonServiceConfig = serviceName: {
|
| + |
environment = env // {
|
| + |
RUST_LOG = lib.mkDefault "info";
|
| + |
};
|
| + |
path = [
|
| + |
pkgs.gitMinimal
|
| + |
];
|
| + |
documentation = [
|
| + |
"https://docs.radicle.xyz/guides/seeder"
|
| + |
];
|
| + |
after = [
|
| + |
"network.target"
|
| + |
"network-online.target"
|
| + |
];
|
| + |
requires = [
|
| + |
"network-online.target"
|
| + |
];
|
| + |
wantedBy = [ "multi-user.target" ];
|
| + |
serviceConfig = lib.mkMerge [
|
| + |
{
|
| + |
BindReadOnlyPaths = [
|
| + |
"${cfg.configFile}:${env.RAD_HOME}/config.json"
|
| + |
"${if lib.types.path.check cfg.publicKey then cfg.publicKey else pkgs.writeText "radicle.pub" cfg.publicKey}:${env.RAD_HOME}/keys/radicle.pub"
|
| + |
];
|
| + |
KillMode = "process";
|
| + |
StateDirectory = [ "radicle" ];
|
| + |
User = config.users.users.radicle.name;
|
| + |
Group = config.users.groups.radicle.name;
|
| + |
WorkingDirectory = env.HOME;
|
| + |
}
|
| + |
# The following options are only for optimizing:
|
| + |
# systemd-analyze security ${serviceName}
|
| + |
{
|
| + |
BindReadOnlyPaths = [
|
| + |
"-/etc/resolv.conf"
|
| + |
"/etc/ssl/certs/ca-certificates.crt"
|
| + |
"/run/systemd"
|
| + |
];
|
| + |
AmbientCapabilities = "";
|
| + |
CapabilityBoundingSet = "";
|
| + |
DeviceAllow = ""; # ProtectClock= adds DeviceAllow=char-rtc r
|
| + |
LockPersonality = true;
|
| + |
MemoryDenyWriteExecute = true;
|
| + |
NoNewPrivileges = true;
|
| + |
PrivateTmp = true;
|
| + |
ProcSubset = "pid";
|
| + |
ProtectClock = true;
|
| + |
ProtectHome = true;
|
| + |
ProtectHostname = true;
|
| + |
ProtectKernelLogs = true;
|
| + |
ProtectProc = "invisible";
|
| + |
ProtectSystem = "strict";
|
| + |
RemoveIPC = true;
|
| + |
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
| + |
RestrictNamespaces = true;
|
| + |
RestrictRealtime = true;
|
| + |
RestrictSUIDSGID = true;
|
| + |
RuntimeDirectoryMode = "700";
|
| + |
SocketBindDeny = [ "any" ];
|
| + |
StateDirectoryMode = "0750";
|
| + |
SystemCallFilter = [
|
| + |
"@system-service"
|
| + |
"~@aio"
|
| + |
"~@chown"
|
| + |
"~@keyring"
|
| + |
"~@memlock"
|
| + |
"~@privileged"
|
| + |
"~@resources"
|
| + |
"~@setuid"
|
| + |
"~@timer"
|
| + |
];
|
| + |
SystemCallArchitectures = "native";
|
| + |
# This is for BindPaths= and BindReadOnlyPaths=
|
| + |
# to allow traversal of directories they create inside RootDirectory=
|
| + |
UMask = "0066";
|
| + |
}
|
| + |
];
|
| + |
confinement = {
|
| + |
enable = true;
|
| + |
mode = "full-apivfs";
|
| + |
packages = [
|
| + |
pkgs.gitMinimal
|
| + |
cfg.package
|
| + |
pkgs.iana-etc
|
| + |
(lib.getLib pkgs.nss)
|
| + |
pkgs.tzdata
|
| + |
];
|
| + |
};
|
| + |
};
|
| + |
in
|
| + |
{
|
| + |
options = {
|
| + |
services.radicle = {
|
| + |
enable = lib.mkEnableOption "Radicle Seed Node";
|
| + |
package = lib.mkPackageOption pkgs "radicle-node" { };
|
| + |
privateKeyFile = lib.mkOption {
|
| + |
# Note that a key encrypted by systemd-creds is not a path but a str.
|
| + |
type = with lib.types; either path str;
|
| + |
description = ''
|
| + |
Absolute file path to an SSH private key,
|
| + |
usually generated by `rad auth`.
|
| + |
|
| + |
If it contains a colon (`:`) the string before the colon
|
| + |
is taken as the credential name
|
| + |
and the string after as a path encrypted with `systemd-creds`.
|
| + |
'';
|
| + |
};
|
| + |
publicKey = lib.mkOption {
|
| + |
type = with lib.types; either path str;
|
| + |
description = ''
|
| + |
An SSH public key (as an absolute file path or directly as a string),
|
| + |
usually generated by `rad auth`.
|
| + |
'';
|
| + |
};
|
| + |
node = {
|
| + |
listenAddress = lib.mkOption {
|
| + |
type = lib.types.str;
|
| + |
default = "[::]";
|
| + |
example = "127.0.0.1";
|
| + |
description = "The IP address on which `radicle-node` listens.";
|
| + |
};
|
| + |
listenPort = lib.mkOption {
|
| + |
type = lib.types.port;
|
| + |
default = 8776;
|
| + |
description = "The port on which `radicle-node` listens.";
|
| + |
};
|
| + |
openFirewall = lib.mkEnableOption "opening the firewall for `radicle-node`";
|
| + |
extraArgs = lib.mkOption {
|
| + |
type = with lib.types; listOf str;
|
| + |
default = [ ];
|
| + |
description = "Extra arguments for `radicle-node`";
|
| + |
};
|
| + |
};
|
| + |
configFile = lib.mkOption {
|
| + |
type = lib.types.package;
|
| + |
internal = true;
|
| + |
default = (json.generate "config.json" cfg.settings).overrideAttrs (previousAttrs: {
|
| + |
preferLocalBuild = true;
|
| + |
# None of the usual phases are run here because runCommandWith uses buildCommand,
|
| + |
# so just append to buildCommand what would usually be a checkPhase.
|
| + |
buildCommand = previousAttrs.buildCommand + lib.optionalString cfg.checkConfig ''
|
| + |
ln -s $out config.json
|
| + |
install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil"
|
| + |
export RAD_HOME=$PWD
|
| + |
${lib.getExe' pkgs.buildPackages.radicle-node "rad"} config >/dev/null || {
|
| + |
cat -n config.json
|
| + |
echo "Invalid config.json according to rad."
|
| + |
echo "Please double-check your services.radicle.settings (producing the config.json above),"
|
| + |
echo "some settings may be missing or have the wrong type."
|
| + |
exit 1
|
| + |
} >&2
|
| + |
'';
|
| + |
});
|
| + |
};
|
| + |
checkConfig = lib.mkEnableOption "checking the {file}`config.json` file resulting from {option}`services.radicle.settings`" // { default = true; };
|
| + |
settings = lib.mkOption {
|
| + |
description = ''
|
| + |
See https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275
|
| + |
'';
|
| + |
default = { };
|
| + |
example = lib.literalExpression ''
|
| + |
{
|
| + |
web.pinned.repositories = [
|
| + |
"rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5" # heartwood
|
| + |
"rad:z3trNYnLWS11cJWC6BbxDs5niGo82" # rips
|
| + |
];
|
| + |
}
|
| + |
'';
|
| + |
type = lib.types.submodule {
|
| + |
freeformType = json.type;
|
| + |
};
|
| + |
};
|
| + |
httpd = {
|
| + |
enable = lib.mkEnableOption "Radicle HTTP gateway to radicle-node";
|
| + |
package = lib.mkPackageOption pkgs "radicle-httpd" { };
|
| + |
listenAddress = lib.mkOption {
|
| + |
type = lib.types.str;
|
| + |
default = "127.0.0.1";
|
| + |
description = "The IP address on which `radicle-httpd` listens.";
|
| + |
};
|
| + |
listenPort = lib.mkOption {
|
| + |
type = lib.types.port;
|
| + |
default = 8080;
|
| + |
description = "The port on which `radicle-httpd` listens.";
|
| + |
};
|
| + |
nginx = lib.mkOption {
|
| + |
# Type of a single virtual host, or null.
|
| + |
type = lib.types.nullOr (lib.types.submodule (
|
| + |
lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
|
| + |
options.serverName = {
|
| + |
default = "radicle-${config.networking.hostName}.${config.networking.domain}";
|
| + |
defaultText = "radicle-\${config.networking.hostName}.\${config.networking.domain}";
|
| + |
};
|
| + |
}
|
| + |
));
|
| + |
default = null;
|
| + |
example = lib.literalExpression ''
|
| + |
{
|
| + |
serverAliases = [
|
| + |
"seed.''${config.networking.domain}"
|
| + |
];
|
| + |
enableACME = false;
|
| + |
useACMEHost = config.networking.domain;
|
| + |
}
|
| + |
'';
|
| + |
description = ''
|
| + |
With this option, you can customize an nginx virtual host which already has sensible defaults for `radicle-httpd`.
|
| + |
Set to `{}` if you do not need any customization to the virtual host.
|
| + |
If enabled, then by default, the {option}`serverName` is
|
| + |
`radicle-''${config.networking.hostName}.''${config.networking.domain}`,
|
| + |
TLS is active, and certificates are acquired via ACME.
|
| + |
If this is set to null (the default), no nginx virtual host will be configured.
|
| + |
'';
|
| + |
};
|
| + |
extraArgs = lib.mkOption {
|
| + |
type = with lib.types; listOf str;
|
| + |
default = [ ];
|
| + |
description = "Extra arguments for `radicle-httpd`";
|
| + |
};
|
| + |
};
|
| + |
};
|
| + |
};
|
| + |
|
| + |
config = lib.mkIf cfg.enable (lib.mkMerge [
|
| + |
{
|
| + |
systemd.services.radicle-node = lib.mkMerge [
|
| + |
(commonServiceConfig "radicle-node")
|
| + |
{
|
| + |
description = "Radicle Node";
|
| + |
documentation = [ "man:radicle-node(1)" ];
|
| + |
serviceConfig = {
|
| + |
ExecStart = "${lib.getExe' cfg.package "radicle-node"} --force --listen ${cfg.node.listenAddress}:${toString cfg.node.listenPort} ${lib.escapeShellArgs cfg.node.extraArgs}";
|
| + |
Restart = lib.mkDefault "on-failure";
|
| + |
RestartSec = "30";
|
| + |
SocketBindAllow = [ "tcp:${toString cfg.node.listenPort}" ];
|
| + |
SystemCallFilter = lib.mkAfter [
|
| + |
# Needed by git upload-pack which calls alarm() and setitimer() when providing a rad clone
|
| + |
"@timer"
|
| + |
];
|
| + |
};
|
| + |
confinement.packages = [
|
| + |
cfg.package
|
| + |
];
|
| + |
}
|
| + |
# Give only access to the private key to radicle-node.
|
| + |
{
|
| + |
serviceConfig =
|
| + |
let keyCred = builtins.split ":" "${cfg.privateKeyFile}"; in
|
| + |
if lib.length keyCred > 1
|
| + |
then {
|
| + |
LoadCredentialEncrypted = [ cfg.privateKeyFile ];
|
| + |
# Note that neither %d nor ${CREDENTIALS_DIRECTORY} works in BindReadOnlyPaths=
|
| + |
BindReadOnlyPaths = [ "/run/credentials/radicle-node.service/${lib.head keyCred}:${env.RAD_HOME}/keys/radicle" ];
|
| + |
}
|
| + |
else {
|
| + |
LoadCredential = [ "radicle:${cfg.privateKeyFile}" ];
|
| + |
BindReadOnlyPaths = [ "/run/credentials/radicle-node.service/radicle:${env.RAD_HOME}/keys/radicle" ];
|
| + |
};
|
| + |
}
|
| + |
];
|
| + |
|
| + |
environment.systemPackages = [
|
| + |
rad-system
|
| + |
];
|
| + |
|
| + |
networking.firewall = lib.mkIf cfg.node.openFirewall {
|
| + |
allowedTCPPorts = [ cfg.node.listenPort ];
|
| + |
};
|
| + |
|
| + |
users = {
|
| + |
users.radicle = {
|
| + |
description = "Radicle";
|
| + |
group = "radicle";
|
| + |
home = env.HOME;
|
| + |
isSystemUser = true;
|
| + |
};
|
| + |
groups.radicle = {
|
| + |
};
|
| + |
};
|
| + |
}
|
| + |
|
| + |
(lib.mkIf cfg.httpd.enable (lib.mkMerge [
|
| + |
{
|
| + |
systemd.services.radicle-httpd = lib.mkMerge [
|
| + |
(commonServiceConfig "radicle-httpd")
|
| + |
{
|
| + |
description = "Radicle HTTP gateway to radicle-node";
|
| + |
documentation = [ "man:radicle-httpd(1)" ];
|
| + |
serviceConfig = {
|
| + |
ExecStart = "${lib.getExe' cfg.httpd.package "radicle-httpd"} --listen ${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort} ${lib.escapeShellArgs cfg.httpd.extraArgs}";
|
| + |
Restart = lib.mkDefault "on-failure";
|
| + |
RestartSec = "10";
|
| + |
SocketBindAllow = [ "tcp:${toString cfg.httpd.listenPort}" ];
|
| + |
SystemCallFilter = lib.mkAfter [
|
| + |
# Needed by git upload-pack which calls alarm() and setitimer() when providing a git clone
|
| + |
"@timer"
|
| + |
];
|
| + |
};
|
| + |
confinement.packages = [
|
| + |
cfg.httpd.package
|
| + |
];
|
| + |
}
|
| + |
];
|
| + |
}
|
| + |
|
| + |
(lib.mkIf (cfg.httpd.nginx != null) {
|
| + |
services.nginx.virtualHosts.${cfg.httpd.nginx.serverName} = lib.mkMerge [
|
| + |
cfg.httpd.nginx
|
| + |
{
|
| + |
forceSSL = lib.mkDefault true;
|
| + |
enableACME = lib.mkDefault true;
|
| + |
locations."/" = {
|
| + |
proxyPass = "http://${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort}";
|
| + |
recommendedProxySettings = true;
|
| + |
};
|
| + |
}
|
| + |
];
|
| + |
|
| + |
services.radicle.settings = {
|
| + |
node.alias = lib.mkDefault cfg.httpd.nginx.serverName;
|
| + |
node.externalAddresses = lib.mkDefault [
|
| + |
"${cfg.httpd.nginx.serverName}:${toString cfg.node.listenPort}"
|
| + |
];
|
| + |
};
|
| + |
})
|
| + |
]))
|
| + |
]);
|
| + |
|
| + |
meta.maintainers = with lib.maintainers; [
|
| + |
julm
|
| + |
lorenzleutgeb
|
| + |
];
|
| + |
}
|
| + |
|