summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorlassulus <lass@aidsballs.de>2015-10-21 19:06:48 +0200
committerlassulus <lass@aidsballs.de>2015-10-21 19:06:48 +0200
commit692a59423ab3ab8fb2f5323af15cdec033d94fda (patch)
treedb9cc8ee6e8299a642a4267354477ba7989782a6
parent27a4aa4a49b9befe278bb4dfa68a749822aea2c0 (diff)
parent6eb195b0bc1b2ecd1a39c842da4d14d4837d98cc (diff)
Merge remote-tracking branch 'pnp/master'
-rw-r--r--krebs/3modules/makefu/default.nix15
-rw-r--r--krebs/3modules/nginx.nix2
-rw-r--r--krebs/3modules/retiolum-bootstrap.nix22
-rw-r--r--makefu/1systems/wry.nix73
-rw-r--r--makefu/2configs/bepasty-dual.nix52
-rw-r--r--makefu/2configs/exim-retiolum.nix4
-rw-r--r--makefu/2configs/unstable-sources.nix19
-rw-r--r--makefu/3modules/bepasty-server.nix48
-rw-r--r--makefu/3modules/default.nix1
-rw-r--r--makefu/3modules/tinc_graphs.nix58
10 files changed, 199 insertions, 95 deletions
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 42764e48c..4f8f964f8 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -163,10 +163,11 @@ with lib;
dc = "makefu"; #dc = "cac";
extraZones = {
"krebsco.de" = ''
- wry IN A ${head nets.internet.addrs4}
- io IN NS wry.krebsco.de.
- graphs IN A ${head nets.internet.addrs4}
- tinc IN A ${head nets.internet.addrs4}
+ wry IN A ${head nets.internet.addrs4}
+ io IN NS wry.krebsco.de.
+ graphs IN A ${head nets.internet.addrs4}
+ paste 60 IN A ${head nets.internet.addrs4}
+ tinc IN A ${head nets.internet.addrs4}
'';
};
nets = rec {
@@ -174,6 +175,7 @@ with lib;
addrs4 = ["104.233.87.86"];
aliases = [
"wry.internet"
+ "paste.internet"
];
};
retiolum = {
@@ -182,6 +184,8 @@ with lib;
addrs6 = ["42:6e1e:cc8a:7cef:827:f938:8c64:baad"];
aliases = [
"graphs.wry.retiolum"
+ "paste.wry.retiolum"
+ "paste.retiolum"
"wry.retiolum"
];
tinc.pubkey = ''
@@ -210,8 +214,7 @@ with lib;
"krebsco.de" = ''
omo IN A ${head nets.internet.addrs4}
euer IN A ${head nets.internet.addrs4}
- gum IN A ${head nets.internet.addrs4}
- paste IN A ${head nets.internet.addrs4}'';
+ gum IN A ${head nets.internet.addrs4} '';
};
nets = {
internet = {
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 0530921a0..921771033 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -36,7 +36,7 @@ let
type = with types; listOf (attrsOf str);
};
extraConfig = mkOption {
- type = with types; str;
+ type = with types; string;
default = "";
};
};
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index eed11642f..65bb51193 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -16,6 +16,14 @@ let
description = "hostname which serves tinc boot";
default = "tinc.krebsco.de" ;
};
+ listen = mkOption {
+ type = with types; listOf str;
+ description = ''Addresses to listen on (nginx-syntax).
+ ssl will be configured, http will be redirected to ssl.
+ Make sure to have at least 1 ssl port configured.
+ '';
+ default = [ "80" "443 ssl" ] ;
+ };
ssl_certificate_key = mkOption {
type = types.str;
description = "Certificate key to use for ssl";
@@ -33,19 +41,17 @@ let
imp = {
krebs.nginx.servers = assert config.krebs.nginx.enable; {
- retiolum-boot-redir = {
- server-names = singleton cfg.hostname;
- extraConfig = ''
- return 301 https://$server_name$request_uri;
- '';
- locations = [];
- };
retiolum-boot-ssl = {
server-names = singleton cfg.hostname;
- listen = "443 ssl";
+ listen = cfg.listen;
extraConfig = ''
ssl_certificate ${cfg.ssl_certificate};
ssl_certificate_key ${cfg.ssl_certificate_key};
+
+ if ($scheme = http){
+ return 301 https://$server_name$request_uri;
+ }
+
root ${pkgs.retiolum-bootstrap};
try_files $uri $uri/retiolum.sh;
'';
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index a7ed93c43..63b1f47f7 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -1,59 +1,72 @@
{ config, lib, pkgs, ... }:
+with lib;
let
- ip = (lib.head config.krebs.build.host.nets.internet.addrs4);
+ external-ip = head config.krebs.build.host.nets.internet.addrs4;
+ internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
in {
imports = [
# TODO: copy this config or move to krebs
../../tv/2configs/CAC-CentOS-7-64bit.nix
../2configs/base.nix
- ../2configs/base-sources.nix
+ ../2configs/unstable-sources.nix
../2configs/tinc-basic-retiolum.nix
+ ../2configs/bepasty-dual.nix
+
../2configs/iodined.nix
# Reaktor
../2configs/Reaktor/simpleExtend.nix
];
- krebs.Reaktor.enable = true;
+ krebs.build = {
+ user = config.krebs.users.makefu;
+ target = "root@wry";
+ host = config.krebs.hosts.wry;
+ };
- networking.firewall.allowPing = true;
- networking.interfaces.enp2s1.ip4 = [
- {
- address = ip;
- prefixLength = 24;
- }
- ];
- networking.defaultGateway = "104.233.87.1";
- networking.nameservers = [
- "8.8.8.8"
- ];
- # based on ../../tv/2configs/CAC-Developer-2.nix
- sound.enable = false;
- # prepare graphs
- nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+ krebs.Reaktor.enable = true;
+
+ # bepasty to listen only on the correct interfaces
+ krebs.bepasty.servers.internal.nginx.listen = [ "${internal-ip}:80" ];
+ krebs.bepasty.servers.external.nginx.listen = [ "${external-ip}:80" "${external-ip}:443 ssl" ];
+ # prepare graphs
krebs.nginx.enable = true;
krebs.retiolum-bootstrap.enable = true;
- makefu.tinc_graphs.enable = true;
- makefu.tinc_graphs.krebsNginx = {
+ nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+ makefu.tinc_graphs = {
enable = true;
- # TODO: remove hard-coded hostname
- hostnames_complete = [ "graphs.wry" ];
- hostnames_anonymous = [ "graphs.krebsco.de" ];
+ nginx = {
+ enable = true;
+ # TODO: remove hard-coded hostname
+ complete = {
+ listen = [ "${internal-ip}:80" ];
+ server-names = [ "graphs.wry" ];
+ };
+ anonymous = {
+ listen = [ "${external-ip}:80" ] ;
+ server-names = [ "graphs.krebsco.de" ];
+ };
+ };
};
-
- networking.firewall.allowedTCPPorts = [ 53 80 443 ];
-
- krebs.build = {
- user = config.krebs.users.makefu;
- target = "root@${ip}";
- host = config.krebs.hosts.wry;
+ networking = {
+ firewall.allowPing = true;
+ firewall.allowedTCPPorts = [ 53 80 443 ];
+ interfaces.enp2s1.ip4 = [{
+ address = external-ip;
+ prefixLength = 24;
+ }];
+ defaultGateway = "104.233.87.1";
+ nameservers = [ "8.8.8.8" ];
};
+
+ # based on ../../tv/2configs/CAC-Developer-2.nix
+ sound.enable = false;
}
diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
new file mode 100644
index 000000000..fb170957a
--- /dev/null
+++ b/makefu/2configs/bepasty-dual.nix
@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+# 1systems should configure itself:
+# krebs.bepasty.servers.internal.nginx.listen = [ "80" ]
+# krebs.bepasty.servers.external.nginx.listen = [ "80" "443 ssl" ]
+# 80 is redirected to 443 ssl
+
+# secrets used:
+# wildcard.krebsco.de.crt
+# wildcard.krebsco.de.key
+# bepasty-secret.nix <- contains single string
+
+with lib;
+{
+
+ krebs.nginx.enable = mkDefault true;
+ krebs.bepasty = {
+ enable = true;
+ serveNginx= true;
+
+ servers = {
+ internal = {
+ nginx = {
+ server-names = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
+ };
+ defaultPermissions = "admin,list,create,read,delete";
+ secretKey = import <secrets/bepasty-secret.nix>;
+ };
+
+ external = {
+ nginx = {
+ server-names = [ "paste.krebsco.de" ];
+ extraConfig = ''
+ ssl_session_cache shared:SSL:1m;
+ ssl_session_timeout 10m;
+ ssl_certificate /root/secrets/wildcard.krebsco.de.crt;
+ ssl_certificate_key /root/secrets/wildcard.krebsco.de.key;
+ ssl_verify_client off;
+ proxy_ssl_session_reuse off;
+ ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ ssl_ciphers RC4:HIGH:!aNULL:!MD5;
+ ssl_prefer_server_ciphers on;
+ if ($scheme = http){
+ return 301 https://$server_name$request_uri;
+ }'';
+ };
+ defaultPermissions = "read";
+ secretKey = import <secrets/bepasty-secret.nix>;
+ };
+ };
+ };
+}
diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix
index cebfd7cea..b8c5c5236 100644
--- a/makefu/2configs/exim-retiolum.nix
+++ b/makefu/2configs/exim-retiolum.nix
@@ -5,10 +5,6 @@ with lib;
krebs.exim-retiolum.enable = true;
environment.systemPackages = with pkgs; [
msmtp
- mutt-kz
- notmuch
- # TODO: put this somewhere else
- offlineimap
];
}
diff --git a/makefu/2configs/unstable-sources.nix b/makefu/2configs/unstable-sources.nix
new file mode 100644
index 000000000..f2d28dcaf
--- /dev/null
+++ b/makefu/2configs/unstable-sources.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+{
+ krebs.build.source = {
+ git.nixpkgs = {
+ url = https://github.com/makefu/nixpkgs;
+ rev = "984d33884d63d404ff2da76920b8bc8b15471552";
+ };
+
+ dir.secrets = {
+ host = config.krebs.hosts.pornocauster;
+ path = "/home/makefu/secrets/${config.krebs.build.host.name}/";
+ };
+ dir.stockholm = {
+ host = config.krebs.hosts.pornocauster;
+ path = toString ../.. ;
+ };
+ };
+}
diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix
index d970652a4..ff32eea60 100644
--- a/makefu/3modules/bepasty-server.nix
+++ b/makefu/3modules/bepasty-server.nix
@@ -6,10 +6,10 @@ let
bepasty = pkgs.pythonPackages.bepasty-server;
gevent = pkgs.pythonPackages.gevent;
python = pkgs.pythonPackages.python;
- cfg = config.makefu.bepasty-server;
+ cfg = config.krebs.bepasty;
out = {
- options.makefu.bepasty-server = api;
+ options.krebs.bepasty = api;
config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
};
@@ -20,27 +20,20 @@ let
servers = mkOption {
type = with types; attrsOf optionSet;
options = singleton {
- nginxCfg = mkOption {
+ nginx = mkOption {
# TODO use the correct type
type = with types; attrsOf unspecified;
description = ''
additional nginx configuration. see krebs.nginx for all options
'' ;
};
- debug = mkOption {
- type = types.bool;
- description = ''
- run server in debug mode
- '';
- default = false;
- };
- # TODO: assert secretKey
secretKey = mkOption {
type = types.str;
description = ''
server secret for safe session cookies, must be set.
'';
+ default = "";
};
# we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
@@ -66,6 +59,7 @@ let
extraConfig = mkOption {
type = types.str;
default = "";
+ # TODO configure permissions in separate
example = ''
PERMISSIONS = {
'myadminsecret': 'admin,list,create,read,delete',
@@ -75,8 +69,13 @@ let
};
defaultPermissions = mkOption {
+ # TODO: listOf str
type = types.str;
- default = "list";
+ description = ''
+ default permissions for all unauthenticated users.
+ '';
+ example = "read,create,delete";
+ default = "read";
};
};
@@ -102,21 +101,22 @@ let
serviceConfig = {
Type = "simple";
PrivateTmp = true;
- ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" ''
+
+ ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" ''
#!/bin/sh
- chmod 755 ${server.workDir}
- mkdir -p ${server.dataDir}
- cat > ${server.workDir}/bepasty-${name}.conf <<EOF
+ mkdir -p "${server.dataDir}" "${server.workDir}"
+ chown bepasty:bepasty "${server.workDir}" "${server.dataDir}"
+ cat > "${server.workDir}/bepasty-${name}.conf" <<EOF
SITENAME="${name}"
STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
- SECRET_KEY="${escapeShellArg server.secretKey}"
+ SECRET_KEY="${server.secretKey}"
DEFAULT_PERMISSIONS="${server.defaultPermissions}"
${server.extraConfig}
EOF
'';
- Directory = "${bepasty}/lib/${python.libPrefix}/site-packages";
- # we use Gunicorn to start a wsgi server
ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
+ -u bepasty \
+ -g bepasty \
--workers 3 --log-level=info \
--bind=unix:${server.workDir}/gunicorn-${name}.sock \
--pid ${server.workDir}/gunicorn-${name}.pid \
@@ -128,17 +128,21 @@ let
users.extraUsers.bepasty = {
uid = 2796546855; #genid bepasty
+ group = "bepasty";
home = "/var/lib/bepasty-server";
- createHome = true;
+ };
+ users.extraGroups.bepasty = {
+ gid = 2796546855; #genid bepasty
};
};
+
nginx-imp = {
assertions = [ { assertion = config.krebs.nginx.enable;
message = "krebs.nginx.enable must be true"; }];
krebs.nginx.servers = mapAttrs' (name: server:
nameValuePair("bepasty-server-${name}")
- (server.nginxCfg // {
+ (mkMerge [ server.nginx {
extraConfig = ''
client_max_body_size 32M;
'';
@@ -153,7 +157,7 @@ let
alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
''))
];
- })
+ }])
) cfg.servers ;
};
in
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 598365c39..3ac325b29 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -3,6 +3,7 @@ _:
{
imports = [
./tinc_graphs.nix
+ ./bepasty-server.nix
];
}
diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
index ff2f55873..1f87f00cc 100644
--- a/makefu/3modules/tinc_graphs.nix
+++ b/makefu/3modules/tinc_graphs.nix
@@ -20,26 +20,38 @@ let
default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
};
- krebsNginx = {
- # configure krebs nginx to serve the new graphs
- enable = mkEnableOption "tinc_graphs nginx";
+ nginx = {
+ enable = mkEnableOption "enable tinc_graphs to be served with nginx";
+
+ anonymous = {
+ server-names = mkOption {
+ type = with types; listOf str;
+ description = "hostnames which serve anonymous graphs";
+ default = [ "graphs.${config.krebs.build.host.name}" ];
+ };
+
+ listen = mkOption {
+ # use the type of the nginx listen option
+ type = with types; listOf str;
+ description = "listen address for anonymous graphs";
+ default = [ "80" ];
+ };
- hostnames_complete = mkOption {
- #TODO: this is not a secure way to serve these graphs,better listen to
- # the correct interface, krebs.nginx does not support this yet
-
- type = with types; listOf str;
- description = "hostname which serves complete graphs";
- default = [ "graphs.${config.krebs.build.host.name}" ];
};
- hostnames_anonymous = mkOption {
- type = with types; listOf str;
- description = ''
- hostname which serves anonymous graphs
- must be different from hostname_complete
- '';
- default = [ "anongraphs.${config.krebs.build.host.name}" ];
+ complete = {
+ server-names = mkOption {
+ type = with types; listOf str;
+ description = "hostname which serves complete graphs";
+ default = [ "graphs.${config.krebs.build.host.name}" ];
+ };
+
+ listen = mkOption {
+ type = with types; listOf str;
+ description = "listen address for complete graphs";
+ default = [ "127.0.0.1:80" ];
+ };
+
};
};
@@ -109,25 +121,23 @@ let
createHome = true;
};
- krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
- tinc_graphs_complete = {
- server-names = cfg.krebsNginx.hostnames_complete;
+ krebs.nginx.servers = mkIf cfg.nginx.enable {
+ tinc_graphs_complete = mkMerge [ cfg.nginx.complete {
locations = [
(nameValuePair "/" ''
autoindex on;
root ${internal_dir};
'')
];
- };
- tinc_graphs_anonymous = {
- server-names = cfg.krebsNginx.hostnames_anonymous;
+ }] ;
+ tinc_graphs_anonymous = mkMerge [ cfg.nginx.anonymous {
locations = [
(nameValuePair "/" ''
autoindex on;
root ${external_dir};
'')
];
- };
+ }];
};
};