diff options
22 files changed, 183 insertions, 37 deletions
diff --git a/.git-crypt/keys/default/0/C1DAA551B4227A6F3FD96B3A467B7D129EA73AC9.gpg b/.git-crypt/keys/default/0/C1DAA551B4227A6F3FD96B3A467B7D129EA73AC9.gpg new file mode 100644 index 0000000..f7a511c --- /dev/null +++ b/.git-crypt/keys/default/0/C1DAA551B4227A6F3FD96B3A467B7D129EA73AC9.gpg @@ -0,0 +1,2 @@ +^P >@wZ_@6e@ +r{؏ 0}>87el,$Db? f;N51uꉢ;Bn韛;|(hieeC5v;ouGi 6IU>M>c:`h[oC~{A 9ļth/2q^-bz[&8%;tmc uGe a!Nt/1kpZIjҿ]6SQeRnb鯒 0u \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 11a4db1..de4137f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,27 @@ All notable changes to this project will be documented in this file. See [conventional commits](https://www.conventionalcommits.org/) for commit guidelines. - - - +## v0.18.0 - 2023-11-18 +#### Bug Fixes +- **(system/services/taskserver)** Support both ipv4 and ipv6 - (5200f2e) - Soispha +- **(system/services/taskserver)** Support both ipv4 and ipv6 - (6948186) - Soispha +- **(system/users)** change ssh-keys for sils - (0b865b6) - sils +- **(system/users)** add ssh-key for sils - (5e50f8d) - sils +#### Build system +- **(flake)** Update - (257befb) - Soispha +#### Features +- **(git-crypt)** add new key - (d74f1f6) - sils +#### Miscellaneous Chores +- **(merge)** Branch 'taskd' - (288ea14) - Soispha + +- - - + +## v0.17.1 - 2023-11-07 +#### Bug Fixes +- **(system/services/taskserver/certs)** Move cert generation to script - (961729e) - Soispha + +- - - + ## v0.17.0 - 2023-11-03 #### Bug Fixes - **(system/services/taskserver)** Disable debug - (d39bcde) - Soispha diff --git a/flake.lock b/flake.lock index 7d58af5..deeee90 100644 --- a/flake.lock +++ b/flake.lock @@ -45,11 +45,11 @@ ] }, "locked": { - "lastModified": 1699030822, - "narHash": "sha256-a25bCHvTPJfAvK3qLoi5uI2pvwnOYhMQLRpJYNEt55o=", + "lastModified": 1699548976, + "narHash": "sha256-xnpxms0koM8mQpxIup9JnT0F7GrKdvv0QvtxvRuOYR4=", "owner": "ipetkov", "repo": "crane", - "rev": "2c89c36bffac32d8267e719f73b0d06e313ede30", + "rev": "6849911446e18e520970cc6b7a691e64ee90d649", "type": "github" }, "original": { @@ -87,11 +87,11 @@ ] }, "locked": { - "lastModified": 1698422527, - "narHash": "sha256-SDu3Xg263t3oXIyTaH0buOvFnKIDeZsvKDBtOz+jRbs=", + "lastModified": 1699781810, + "narHash": "sha256-LD+PIUbm1yQmQmGIbSsc/PB1dtJtGqXFgxRc1C7LlfQ=", "owner": "nix-community", "repo": "disko", - "rev": "944d338d24a9d043a3f7461c30ee6cfe4f9cca30", + "rev": "2d7d77878c5d70f66f3d676ff66708d8d4f9d7df", "type": "github" }, "original": { @@ -174,11 +174,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1698942558, - "narHash": "sha256-/UmnB+mEd6Eg3mJBrAgqRcyZX//RSjHphcCO7Ig9Bpk=", + "lastModified": 1700200546, + "narHash": "sha256-KK9uSx+qaoyF8VZDq4pED72AW4qTTwkL1lm0AN3ibFA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "621f51253edffa1d6f08d5fce4f08614c852d17e", + "rev": "2af91613c61e71b278ee156099f9390447490e43", "type": "github" }, "original": { @@ -275,11 +275,11 @@ ] }, "locked": { - "lastModified": 1698977568, - "narHash": "sha256-bnbCqPDFdOUcSANJv9Br3q/b1LyK9vyB1I7os5T4jXI=", + "lastModified": 1700273673, + "narHash": "sha256-0XD4JvrQiZ9BDFdH3VTwqZVXTYzOfS7DVblvqHBnWgE=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "321affd863e3e4e669990a1db5fdabef98387b95", + "rev": "616074a1b2a71bbe44da4cc29a64255aecb8d541", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index dfc3fe5..bca5793 100644 --- a/flake.nix +++ b/flake.nix @@ -101,6 +101,9 @@ packages = with pkgs; [ alejandra + # used for certificate generation in the taskserver setup + gnutls + cocogitto git-crypt ragenix.packages."${system}".default diff --git a/system/impermanence/default.nix b/system/impermanence/default.nix index f42c084..dd363ae 100644 --- a/system/impermanence/default.nix +++ b/system/impermanence/default.nix @@ -2,6 +2,7 @@ # TODO: Only activate them if their module is also active imports = [ ./mods/acme.nix + ./mods/etebase-server.nix ./mods/mail.nix ./mods/mastodon.nix ./mods/matrix.nix diff --git a/system/impermanence/mods/etebase-server.nix b/system/impermanence/mods/etebase-server.nix new file mode 100644 index 0000000..cfe5a39 --- /dev/null +++ b/system/impermanence/mods/etebase-server.nix @@ -0,0 +1,10 @@ +{...}: { + environment.persistence."/srv".directories = [ + { + directory = "/var/lib/etebase-server"; + user = "etebase-server"; + group = "etebase-server"; + mode = "0700"; + } + ]; +} diff --git a/system/secrets/default.nix b/system/secrets/default.nix index c0042d7..6107faa 100644 --- a/system/secrets/default.nix +++ b/system/secrets/default.nix @@ -37,6 +37,12 @@ owner = "root"; group = "root"; }; + etebase-server = { + file = ./etebase-server/passwd.tix; + mode = "700"; + owner = "etebase-server"; + group = "etebase-server"; + }; }; }; } diff --git a/system/secrets/etebase-server/passwd.tix b/system/secrets/etebase-server/passwd.tix new file mode 100644 index 0000000..8d8e3c2 --- /dev/null +++ b/system/secrets/etebase-server/passwd.tix @@ -0,0 +1,17 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0UiswNDhQNWpsaFZUQTdY +U3F2TFlrSzhMbmRBWEIyTGQ2VGVramdPTDI4CjRGSnlqUm5rWWJ2Vk5neE56azdt +WitpbXlPWngxSGtEalBKWkRZdHF5QjQKLT4gWDI1NTE5IDRSSW1jcHhocjBIM0tM +ZjRxNUhZWkhkd1c5aVlucTMxTTVhSHRIMHMyU0EKbWlQZ0xKRXUvOWluSkZQRWdp +UjNMQWR3MHNwbUVYbm4vSGJQOGtrb2ZxVQotPiBzc2gtZWQyNTUxOSBPRDhUNGcg +SEpCY1JWZm5yMG1lL3QwUERPVUFqRWo5ZVJEb1JqNGVLS3pXVkhaYk1SYwpjb3dW +UWcrMkdmYTlvckFOYmsvcGwvY1dvc1oxY1FaY2p4eURCK3BIR044Ci0+ICgreWhl +KG9RLWdyZWFzZSAobEpLXVEgNVA3IGQKekx5YVFkeFRBUlJiUis2cFVyWlBPNncK +LS0tIFJxa0hDZUIyYm5uYlhiZjRnNHRLNTRrRW01d1hCL2dCZnByL1M2SkFyQXMK +gsR7erKGQrBhXlcnR73PbnC+PzOQlsBOg6a6DosGyixbnEgZ4DfyeK5Ep1oPB81Q +zcS9AV7h+8NlpmVM4G+0JCIC8I3TTCEQyOPwiu+GVXr4GYy/3stg+pK1htkt2V2M +WraPl//K3kvFln1KRt5lbsVXLX8SYZS4UJDzK25oJElwdNuqXHqwMkTmXjEgnbvS +pjgaNak5ooxHiZfCtzismLx5iL+P/+oohegUPvW16fQTq/eKp3mIjeBZmrWNnTuL +/xlhk0vp0+jS3+TqgGWSwAAqoCp/+TewUZ9f+GhU0/pkU3HP4+tx35rKN2wxerQj +nMbQ8SphigUeMpc501oDRw6X5ZAasoww +-----END AGE ENCRYPTED FILE----- diff --git a/system/secrets/secrets.nix b/system/secrets/secrets.nix index 2fef23d..3314fc6 100644 --- a/system/secrets/secrets.nix +++ b/system/secrets/secrets.nix @@ -17,4 +17,5 @@ in { "miniflux/admin.tix".publicKeys = allSecrets; "mastodon/mail.tix".publicKeys = allSecrets; "taskserver/ca.tix".publicKeys = allSecrets; + "etebase-server/passwd.tix".publicKeys = allSecrets; } diff --git a/system/services/default.nix b/system/services/default.nix index 9998e43..e269dbc 100644 --- a/system/services/default.nix +++ b/system/services/default.nix @@ -1,5 +1,6 @@ {...}: { imports = [ + ./etebase ./fail2ban ./invidious ./keycloak diff --git a/system/services/etebase/default.nix b/system/services/etebase/default.nix new file mode 100644 index 0000000..65cc435 --- /dev/null +++ b/system/services/etebase/default.nix @@ -0,0 +1,42 @@ +{config, ...}: { + services.etebase-server = { + enable = true; + port = 8001; + settings = { + global.secret_file = "${config.age.secrets.etebase-server.path}"; + allowed_hosts = { + allowed_host1 = "etebase.vhack.eu"; + allowed_host2 = "dav.vhack.eu"; + }; + }; + }; + + services.nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedProxySettings = true; + + virtualHosts = { + "etebase.vhack.eu" = { + enableACME = true; + forceSSL = true; + + locations = { + # TODO: Maybe fix permissions to use pregenerated static files which would + # improve performance. + #"/static" = { + # root = config.services.etebase-server.settings.global.static_root; + #}; + "/" = { + proxyPass = "http://127.0.0.1:${builtins.toString config.services.etebase-server.port}"; + }; + }; + serverAliases = [ + "dav.vhack.eu" + ]; + }; + }; + }; +} diff --git a/system/services/nix/default.nix b/system/services/nix/default.nix index ec5fe5d..13be0f0 100644 --- a/system/services/nix/default.nix +++ b/system/services/nix/default.nix @@ -15,6 +15,7 @@ experimental-features = ["nix-command" "flakes"]; trusted-users = [ "root" + "nixremote" "@wheel" ]; }; diff --git a/system/services/taskserver/ca.cert.pem b/system/services/taskserver/certs/ca.cert.pem index d6e5513..d6e5513 100644 --- a/system/services/taskserver/ca.cert.pem +++ b/system/services/taskserver/certs/ca.cert.pem diff --git a/system/services/taskserver/certs/ca.key.pem.gpg b/system/services/taskserver/certs/ca.key.pem.gpg new file mode 100644 index 0000000..f52482d --- /dev/null +++ b/system/services/taskserver/certs/ca.key.pem.gpg Binary files differdiff --git a/system/services/taskserver/certs/check_expire b/system/services/taskserver/certs/check_expire index 59f9dc6..89969cc 100755 --- a/system/services/taskserver/certs/check_expire +++ b/system/services/taskserver/certs/check_expire @@ -1,7 +1,7 @@ #!/bin/sh for cert in *.cert.pem; do - echo $cert - openssl x509 -noout -in $cert -dates - echo + echo "$cert" + openssl x509 -noout -in "$cert" -dates + echo done diff --git a/system/services/taskserver/certs/generate b/system/services/taskserver/certs/generate index 253e4bb..283697f 100755 --- a/system/services/taskserver/certs/generate +++ b/system/services/taskserver/certs/generate @@ -10,13 +10,19 @@ # server.key.pem # server.cert.pem -GENERATION_LOCATION="/run/user/$(id -u)/taskserver/keys"; +GENERATION_LOCATION="/run/user/$(id -u)/taskserver/certs"; +BASEDIR="$(dirname "$0")" +cd "$BASEDIR" || echo "(BUG?) No basedir ('$BASEDIR')" 1>&2 + +set -- ./vars ./generate.ca ./generate.crl ./generate.client ./ca.key.pem.gpg ./isrgrootx1.pem mkdir -p "$GENERATION_LOCATION" -cp ./vars ./generate.ca ./generate.crl ./generate.client "$GENERATION_LOCATION" +cp "$@" "./ca.cert.pem" "$GENERATION_LOCATION" cd "$GENERATION_LOCATION" || echo "(BUG?) No possible location fould!" 1>&2 -./generate.ca +gpg --decrypt ca.key.pem.gpg > ca.key.pem +cat ./isrgrootx1.pem >> ./ca.cert.pem +[ -f ./ca.key.pem ] || ./generate.ca # Generate a certificate revocation list (CRL). The initial CRL is empty, but # can grow over time. Creates: @@ -28,14 +34,15 @@ cd "$GENERATION_LOCATION" || echo "(BUG?) No possible location fould!" 1>&2 # process per client; Add the required client names and uncomment # ./generate.client <client_name> # -./generate.client soispha -./generate.client android-mobile -./generate.client android-tab # # Creates: # <client_name>.key.pem # <client_name>.cert.pem +# +./generate.client soispha +./generate.client android-mobile +./generate.client android-tab -rm ./vars ./generate.ca ./generate.crl ./generate.client +rm "$@" "./ca.key.pem" echo "(INFO) Look for the keys at: $GENERATION_LOCATION" diff --git a/system/services/taskserver/certs/generate.ca b/system/services/taskserver/certs/generate.ca index 4ffc6e9..a9fbc0c 100755 --- a/system/services/taskserver/certs/generate.ca +++ b/system/services/taskserver/certs/generate.ca @@ -35,7 +35,7 @@ EOF #locality = $LOCALITY fi -if ! [ -f ca.cert.pem ] || [ ca.template -nt ca.cert.pem ] +if ! [ -f ca.cert.pem ] then $CERTTOOL \ --generate-self-signed \ diff --git a/system/services/taskserver/certs/generate.client b/system/services/taskserver/certs/generate.client index 976cb82..4f0e503 100755 --- a/system/services/taskserver/certs/generate.client +++ b/system/services/taskserver/certs/generate.client @@ -16,21 +16,21 @@ then NAME=$1 fi -if ! [ -f ${NAME}.key.pem ] +if ! [ -f "$NAME".key.pem ] then # Create a client key. $CERTTOOL \ --generate-privkey \ --sec-param $SEC_PARAM \ - --outfile ${NAME}.key.pem + --outfile "$NAME".key.pem fi -chmod 600 ${NAME}.key.pem +chmod 600 "$NAME".key.pem -if ! [ -f ${NAME}.template ] +if ! [ -f "$NAME".template ] then # Sign a client cert with the key. - cat <<EOF >${NAME}.template + cat <<EOF >"$NAME".template organization = $ORGANIZATION cn = $CN expiration_days = $EXPIRATION_DAYS @@ -40,15 +40,15 @@ signing_key EOF fi -if ! [ -f ${NAME}.cert.pem ] || [ ${NAME}.template -nt ${NAME}.cert.pem ] +if ! [ -f "$NAME".cert.pem ] then $CERTTOOL \ --generate-certificate \ - --load-privkey ${NAME}.key.pem \ + --load-privkey "$NAME".key.pem \ --load-ca-certificate ca.cert.pem \ --load-ca-privkey ca.key.pem \ - --template ${NAME}.template \ - --outfile ${NAME}.cert.pem + --template "$NAME".template \ + --outfile "$NAME".cert.pem fi -chmod 600 ${NAME}.cert.pem +chmod 600 "$NAME".cert.pem diff --git a/system/services/taskserver/certs/generate.crl b/system/services/taskserver/certs/generate.crl index 6a9daa8..e9f6715 100755 --- a/system/services/taskserver/certs/generate.crl +++ b/system/services/taskserver/certs/generate.crl @@ -18,7 +18,7 @@ expiration_days = $EXPIRATION_DAYS EOF fi -if ! [ -f server.crl.pem ] || [ crl.template -nt server.crl.pem ] +if ! [ -f server.crl.pem ] then $CERTTOOL \ --generate-crl \ diff --git a/system/services/taskserver/certs/isrgrootx1.pem b/system/services/taskserver/certs/isrgrootx1.pem new file mode 100644 index 0000000..b85c803 --- /dev/null +++ b/system/services/taskserver/certs/isrgrootx1.pem @@ -0,0 +1,31 @@ +-----BEGIN CERTIFICATE----- +MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 +WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu +ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY +MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc +h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ +0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U +A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW +T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH +B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC +B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv +KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn +OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn +jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw +qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI +rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq +hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL +ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ +3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK +NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 +ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur +TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC +jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc +oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq +4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA +mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d +emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= +-----END CERTIFICATE----- diff --git a/system/services/taskserver/default.nix b/system/services/taskserver/default.nix index cd842a1..79ba8ab 100644 --- a/system/services/taskserver/default.nix +++ b/system/services/taskserver/default.nix @@ -7,7 +7,7 @@ in { services.taskserver = { enable = true; pki.manual = { - ca.cert = ./ca.cert.pem; + ca.cert = ./certs/ca.cert.pem; server = { cert = "${taskStore}/fullchain.pem"; key = "${taskStore}/key.pem"; @@ -21,7 +21,10 @@ in { organisations = import ./organisations.nix; openFirewall = true; fqdn = "taskserver.vhack.eu"; - listenHost = "taskserver.vhack.eu"; + + # This should tell taskd to bind to both ipv6 and ipv4 domains: + # This will ONLY work when the kernel option `sys.net.ipv6.bindv6only` is false + listenHost = "::"; }; security.acme.certs.taskserver = { domain = "taskserver.vhack.eu"; diff --git a/system/users/default.nix b/system/users/default.nix index 06020a6..8d4fe34 100644 --- a/system/users/default.nix +++ b/system/users/default.nix @@ -18,7 +18,7 @@ "wheel" ]; openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG63gxw8JePmrC8Fni0pLV4TnPBhCPmSV9FYEdva+6s7 sils" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe4o1PM6VasT3KZNl5NYvgkkBrPOg36dqsywd10FztS openpgp:0x21D20D6A" ]; }; |