config/modules/services/nsd-acme/default.nix

222 lines
6.3 KiB
Nix
Raw Normal View History

2023-08-09 14:24:43 +03:00
{
config,
lib,
pkgs,
...
2024-07-29 15:39:54 +03:00
}:
let
2023-09-23 22:25:58 +03:00
cfg = config.mj.services.nsd-acme;
2024-07-29 15:39:54 +03:00
mkHook =
zone:
let
fullZone = "_acme-endpoint.${zone}";
in
2023-08-09 14:24:43 +03:00
pkgs.writeShellScript "nsd-acme-hook" ''
2023-08-10 00:26:16 +03:00
set -euo pipefail
2023-08-09 14:24:43 +03:00
METHOD=$1
TYPE=$2
AUTH=$5
NOW=$(date +%y%m%d%H%M)
2023-08-09 23:22:08 +03:00
DIR="/var/lib/nsd/acmezones"
2023-08-09 14:24:43 +03:00
[ "$TYPE" != "dns-01" ] && { exit 1; }
2023-08-09 14:24:43 +03:00
write_zone() {
cat <<EOF
\$ORIGIN ${fullZone}.
\$TTL 60
@ SOA ${fullZone}. motiejus.jakstys.lt. ($NOW 12h 2h 2w 1h)
@ TXT $AUTH
EOF
}
cleanup() {
nsd-control delzone ${fullZone}
2023-08-09 23:22:08 +03:00
rm -f "$DIR/${fullZone}.zone"
2023-08-09 14:24:43 +03:00
}
2023-08-09 23:22:08 +03:00
mkdir -p "$DIR"
2023-08-09 14:24:43 +03:00
case "$METHOD" in
begin)
2023-08-09 23:22:08 +03:00
nsd-control delzone ${fullZone} || :
write_zone > "$DIR/${fullZone}.zone"
nsd-control addzone ${fullZone} acme
2023-08-09 14:24:43 +03:00
;;
done)
cleanup
;;
failed)
2023-08-10 00:26:16 +03:00
cleanup
2023-08-09 14:24:43 +03:00
;;
esac
'';
2024-07-29 15:39:54 +03:00
in
{
2023-08-09 14:24:43 +03:00
options.mj.services.nsd-acme = with lib.types; {
enable = lib.mkEnableOption "enable acme certs via nsd";
zones = lib.mkOption {
2024-07-29 15:39:54 +03:00
default = { };
type = attrsOf (
submodule (
{ name, ... }:
{
options = {
accountKey = lib.mkOption { type = path; };
days = lib.mkOption {
type = int;
default = 30;
};
staging = lib.mkOption {
type = bool;
default = false;
};
2024-07-29 15:39:54 +03:00
# Warning: paths here are here to be read from. Changing them will
# not place the files somewhere else.
certFile = lib.mkOption {
type = str;
default = "/var/lib/nsd-acme/${name}/${name}/cert.pem";
};
keyFile = lib.mkOption {
type = str;
default = "/var/lib/nsd-acme/${name}/private/${name}/key.pem";
};
};
2024-07-29 15:39:54 +03:00
}
)
);
2023-08-09 14:24:43 +03:00
};
};
# TODO assert services.nsd.enable
2023-09-23 22:25:58 +03:00
config = lib.mkIf cfg.enable {
2023-08-09 14:24:43 +03:00
services.nsd.remoteControl.enable = true;
services.nsd.extraConfig = ''
pattern:
name: "acme"
2023-08-09 23:22:08 +03:00
zonefile: "/var/lib/nsd/acmezones/%s.zone"
2023-08-09 14:24:43 +03:00
'';
2023-11-27 18:17:27 +02:00
systemd = {
2024-07-29 15:39:54 +03:00
tmpfiles.rules = [ "d /var/lib/nsd/acmezones 0755 nsd nsd -" ];
2023-08-09 23:22:08 +03:00
2023-11-27 18:17:27 +02:00
services =
{
nsd-control-setup = {
2024-07-29 15:39:54 +03:00
requiredBy = [ "nsd.service" ];
before = [ "nsd.service" ];
unitConfig.ConditionPathExists =
let
rc = config.services.nsd.remoteControl;
in
[
"|!${rc.controlKeyFile}"
"|!${rc.controlCertFile}"
"|!${rc.serverKeyFile}"
"|!${rc.serverCertFile}"
];
2023-08-09 14:24:43 +03:00
serviceConfig = {
2023-11-27 18:17:27 +02:00
Type = "oneshot";
2024-07-29 15:39:54 +03:00
UMask = 77;
2023-11-27 18:17:27 +02:00
};
script = ''
${pkgs.nsd}/bin/nsd-control-setup
chown nsd:nsd /etc/nsd/nsd_{control,server}.{key,pem}
'';
2024-07-29 15:39:54 +03:00
path = [ pkgs.openssl ];
2023-11-27 18:17:27 +02:00
};
}
2024-07-29 15:39:54 +03:00
// lib.mapAttrs' (
2023-11-27 18:17:27 +02:00
zone: cfg:
2024-07-29 15:39:54 +03:00
lib.nameValuePair "nsd-acme-${zone}" {
description = "dns-01 acme update for ${zone}";
path = [
pkgs.openssh
pkgs.nsd
];
preStart = ''
mkdir -p "$STATE_DIRECTORY/private"
ln -sf "$CREDENTIALS_DIRECTORY/letsencrypt-account-key" \
"$STATE_DIRECTORY/private/key.pem"
'';
serviceConfig = {
ExecStart =
let
2023-11-27 18:17:27 +02:00
hook = mkHook zone;
days = builtins.toString cfg.days;
2024-07-29 15:39:54 +03:00
in
"${pkgs.uacme}/bin/uacme -c \${STATE_DIRECTORY} --verbose --days ${days} --hook ${hook} ${lib.optionalString cfg.staging "--staging"} issue ${zone}";
2023-08-09 23:22:08 +03:00
2024-07-29 15:39:54 +03:00
UMask = "0022";
User = "nsd";
Group = "nsd";
StateDirectory = "nsd-acme/${zone}";
LoadCredential = [ "letsencrypt-account-key:${cfg.accountKey}" ];
ReadWritePaths = [ "/var/lib/nsd/acmezones" ];
SuccessExitStatus = [
0
1
];
2023-08-09 23:22:08 +03:00
2024-07-29 15:39:54 +03:00
# from nixos/modules/security/acme/default.nix
ProtectSystem = "strict";
PrivateTmp = true;
CapabilityBoundingSet = [ "" ];
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
ProtectClock = true;
ProtectHome = true;
ProtectHostname = true;
ProtectControlGroups = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProcSubset = "pid";
RemoveIPC = true;
# "cannot get devices"
#RestrictAddressFamilies = [
# "AF_INET"
# "AF_INET6"
#];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
# 1. allow a reasonable set of syscalls
"@system-service @resources"
# 2. and deny unreasonable ones
"~@privileged"
# 3. then allow the required subset within denied groups
"@chown"
];
};
}
) cfg.zones;
2023-08-09 14:24:43 +03:00
2024-07-29 15:39:54 +03:00
timers = lib.mapAttrs' (
zone: _:
lib.nameValuePair "nsd-acme-${zone}" {
description = "nsd-acme for zone ${zone}";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "*-*-* 01:30";
};
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
}
) cfg.zones;
2023-11-27 18:17:27 +02:00
};
2023-08-10 00:46:36 +03:00
2024-07-29 15:39:54 +03:00
mj.base.unitstatus.units = lib.mkIf config.mj.base.unitstatus.enable (
[ "nsd-control-setup" ] ++ map (z: "nsd-acme-${z}") (lib.attrNames cfg.zones)
);
2023-08-09 14:24:43 +03:00
};
}