WIP: temmie/userweb: inject users from passwd into httpd sandbox

hosts/temmie/services/userweb/default.nix

@@ -154,6 +154,11 @@ in
     ./mail.nix
   ];
 
+  sops.secrets = {
+    "httpd/passwd-ssh-key" = { };
+    "httpd/ssh-known-hosts" = { };
+  };
+
   services.httpd = {
     enable = true;
     adminAddr = "drift@pvv.ntnu.no";
@@ -276,11 +281,49 @@ in
     serviceConfig = {
       Type = lib.mkForce "notify";
 
+      ExecStartPre = let
+        rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
+      in lib.mkForce [
+        (lib.getExe (pkgs.writeShellApplication {
+          name = "http-exec-start-pre-remove-old-semaphores";
+          text = ''
+            # Get rid of old semaphores.  These tend to accumulate across
+            # server restarts, eventually preventing it from restarting
+            # successfully.
+            for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
+                ${pkgs.util-linux}/bin/ipcrm -s "$i"
+            done
+          '';
+        }))
+        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-sync/"
+        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-sync/"
+        # "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/shadow /run/httpd/pamunix-sync/"
+        (let
+          args = lib.cli.toCommandLineShellGNU { } {
+            passwd-file = "/run/httpd/pamunix-sync/passwd";
+            group-file = "/run/httpd/pamunix-sync/group";
+            shadow-file = pkgs.emptyFile;
+            email-domain = "pvv.ntnu.no";
+            ignore-user-file = toString ./ignore_user_file.txt;
+            ignore-group-file = toString ./ignore_group_file.txt;
+            set-default-umask = "0077";
+            set-default-mount-no-devices = "true";
+            set-default-mount-no-suid = "true";
+            set-default-mount-no-execute = "false";
+          };
+        in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
+        "${lib.getExe' pkgs.coreutils "shred"} /run/httpd/pamunix-sync/passwd /run/httpd/pamunix-sync/group"
+      ];
       ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
       ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
       ExecStop = lib.mkForce "";
       KillMode = "mixed";
 
+      LoadCredential=[
+        "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
+      ];
+
       ConfigurationDirectory = [ "httpd" ];
       LogsDirectory = [ "httpd" ];
       LogsDirectoryMode = "0700";
@@ -318,7 +361,11 @@ in
       ];
       UMask = "0077";
 
-      RuntimeDirectory = [ "httpd/root-mnt" ];
+      RuntimeDirectory = [
+        "httpd/root-mnt"
+        "httpd/pamunix-sync"
+        "httpd/systemd-userdb"
+      ];
       RootDirectory = "/run/httpd/root-mnt";
       MountAPIVFS = true;
       BindReadOnlyPaths = [

hosts/temmie/services/userweb/ignore_group_file.txt

@@ -0,0 +1,91 @@
+Debian-exim
+_cvsadmin
+_ssh
+adm
+audio
+avahi
+backup
+bin
+cdrom
+cl-builder
+clamav
+clock
+colord
+courier
+crontab
+daemon
+debian-spamd
+dialout
+dip
+dirmngr
+disk
+dovecot
+fax
+floppy
+fuse
+games
+geoclue
+gnats
+input
+irc
+kmem
+kvm
+list
+lock
+lp
+lpadmin
+mail
+man
+messagebus
+mlocate
+munin
+netdev
+news
+nogroup
+ntp
+ntpsec
+oident
+opendkim
+operator
+plocate
+plugdev
+polkitd
+postdrop
+postfix
+postgres
+prometheus
+prometheus-exporter
+proxy
+rdma
+root
+# runit
+salt
+sambashare
+saned
+sasl
+scanner
+sgx
+shadow
+src
+ssl-cert
+staff
+stunnel4
+sudo
+sys
+systemd-coredump
+systemd-journal
+systemd-network
+systemd-resolve
+systemd-timesync
+tape
+tcpdump
+tty
+users
+utempter
+utmp
+uucp
+uuidd
+video
+voice
+winbindd_priv
+www-data

hosts/temmie/services/userweb/ignore_user_file.txt

@@ -0,0 +1,74 @@
+# System Users
+Debian-exim
+_apt
+_rpc
+avahi
+backup
+bin
+cl-builder
+clamav
+colord
+courier
+daemon
+debian-spamd
+debian-spamd
+dirmngr
+distccd
+dovecot
+dovenull
+driftsupport
+fetchmail
+games
+geoclue
+gitea
+gnats
+hplip
+irc
+list
+lp
+mail
+mail2news
+mailnews
+man
+messagebus
+munin
+news
+nobody
+noone
+ntp
+ntpsec
+oident
+opendkim
+polkitd
+postfix
+postgres
+prometheus
+prometheus-exporter
+proxy
+root
+rwhod
+salt
+saned
+spamd
+sshd
+statd
+stunnel4
+sync
+sys
+systemd-coredump
+systemd-network
+systemd-resolve
+systemd-timesync
+tcpdump
+uucp
+uuidd
+vaultwarden
+www-data
+
+# Misc
+nuccc04
+nuccc
+kybkokos
+kybkokos2
+testbruker2309
+testbruker2404