blob: e4c1de3d04ec9171ffe955f85253596dc4d16cfb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
self:
{ config, lib, pkgs, ... }:
let
format = pkgs.formats.toml {};
cfg = config.services.minorskulk;
config_file = format.generate "Rocket.toml" {
default = {
ident = "minor skulk";
limits.string = "32KiB";
limits.bytes = "128KiB";
}
// cfg.settings
// {
vapid_key = "vapid.key";
};
};
pkg = self.packages.${config.nixpkgs.system}.default;
in
{
options.services.minorskulk = with lib; {
enable = mkEnableOption (mdDoc "the minor-skulk firefox accounts server");
settings = mkOption {
type = types.submodule {
freeformType = format.type;
options = {
database_url = mkOption {
type = types.str;
default = "postgres:///minorskulk";
description = mdDoc ''
Database to use for storage. Only postgres is supported at this time.
'';
};
location = mkOption {
type = types.str;
example = "https://minorskulk.my.domain";
description = mdDoc ''
Web location of the API endpoints.
'';
};
token_server_location = mkOption {
type = types.str;
example = "https://syncstorage.my.domain";
description = mdDoc ''
Web location of the syncstorage token server.
'';
};
vapid_subject = mkOption {
type = types.str;
example = "minorskulk@my.domain";
description = mdDoc ''
VAPID subject added to push messages sent over mozilla push services.
'';
};
vapid_key = mkOption {
type = types.path;
example = "/etc/secrets/minorskulk-vapid-key";
description = mdDoc ''
VAPID key used to sign push messages sent over mozilla push services.
'';
};
mail_from = mkOption {
type = types.str;
example = "minorskulk@my.domain";
description = mdDoc ''
Sender address for generated emails.
'';
};
};
};
description = mdDoc ''
Settings for minor-skulk. Will we written to Rocket.toml.
'';
};
};
config = lib.mkIf cfg.enable {
services.postgresql = {
enable = true;
ensureDatabases = [ "minorskulk" ];
ensureUsers = [ {
name = "minorskulk";
ensurePermissions = {
"DATABASE minorskulk" = "ALL PRIVILEGES";
};
} ];
};
systemd.services.minorskulk = {
wantedBy = [ "multi-user.target" ];
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
path = [ pkg ];
script = ''
umask 0077
cd "$RUNTIME_DIRECTORY"
cp ${config_file} Rocket.toml
cp "$CREDENTIALS_DIRECTORY/vapid" vapid.key
exec minorskulk
'';
serviceConfig = {
User = "minorskulk";
Group = "minorskulk";
LoadCredential = "vapid:${cfg.settings.vapid_key}";
RuntimeDirectory = "minorskulk";
AmbientCapabilities = [ "" ];
CapabilityBoundingSet = [ "" ];
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = true;
RemoveIPC = true;
RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~ @resources @privileged"
];
UMask = "0077";
};
};
};
}
|
