felixalb/pvv-nixos-config
1
0
Fork 0
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git synced 2026-05-31 02:11:13 +02:00
Code Issues Projects Releases Wiki Activity

WIP: temmie/userweb: inject users from passwd into httpd sandbox

Browse Source
This commit is contained in:
h7x4
2026-05-29 23:00:10 +09:00
parent e05eab4ddf
commit 630cbe2e78
7 changed files with 345 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
hosts/temmie/services/userweb/default.nix
View File

@@ -154,6 +154,11 @@ in
./mail.nix
];
sops.secrets = {
"httpd/passwd-ssh-key" = { };
"httpd/ssh-known-hosts" = { };
};
services.httpd = {
enable = true;
adminAddr = "drift@pvv.ntnu.no";
@@ -276,11 +281,49 @@ in
serviceConfig = {
Type = lib.mkForce "notify";
ExecStartPre = let
rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
in lib.mkForce [
(lib.getExe (pkgs.writeShellApplication {
name = "http-exec-start-pre-remove-old-semaphores";
text = ''
# Get rid of old semaphores. These tend to accumulate across
# server restarts, eventually preventing it from restarting
# successfully.
for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
${pkgs.util-linux}/bin/ipcrm -s "$i"
done
'';
}))
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-sync/"
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-sync/"
# "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/shadow /run/httpd/pamunix-sync/"
(let
args = lib.cli.toCommandLineShellGNU { } {
passwd-file = "/run/httpd/pamunix-sync/passwd";
group-file = "/run/httpd/pamunix-sync/group";
shadow-file = pkgs.emptyFile;
email-domain = "pvv.ntnu.no";
ignore-user-file = toString ./ignore_user_file.txt;
ignore-group-file = toString ./ignore_group_file.txt;
set-default-umask = "0077";
set-default-mount-no-devices = "true";
set-default-mount-no-suid = "true";
set-default-mount-no-execute = "false";
};
in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
"${lib.getExe' pkgs.coreutils "shred"} /run/httpd/pamunix-sync/passwd /run/httpd/pamunix-sync/group"
];
ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
ExecStop = lib.mkForce "";
KillMode = "mixed";
LoadCredential=[
"sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
"ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
];
ConfigurationDirectory = [ "httpd" ];
LogsDirectory = [ "httpd" ];
LogsDirectoryMode = "0700";
@@ -318,7 +361,11 @@ in
];
UMask = "0077";
RuntimeDirectory = [ "httpd/root-mnt" ];
RuntimeDirectory = [
"httpd/root-mnt"
"httpd/pamunix-sync"
"httpd/systemd-userdb"
];
RootDirectory = "/run/httpd/root-mnt";
MountAPIVFS = true;
BindReadOnlyPaths = [