summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--krebs/2configs/ircd.nix1
-rw-r--r--krebs/3modules/buildbot/slave.nix2
-rw-r--r--lass/2configs/pass.nix2
-rw-r--r--lass/2configs/websites/lassulus.nix32
-rw-r--r--lass/3modules/ejabberd/config.nix218
-rw-r--r--lass/3modules/ejabberd/default.nix41
6 files changed, 168 insertions, 128 deletions
diff --git a/krebs/2configs/ircd.nix b/krebs/2configs/ircd.nix
index 116337733..38f58952e 100644
--- a/krebs/2configs/ircd.nix
+++ b/krebs/2configs/ircd.nix
@@ -92,6 +92,7 @@
};
general {
#maybe we want ident someday?
+ default_floodcount = 1000;
disable_auth = yes;
throttle_duration = 1;
throttle_count = 1000;
diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix
index 544f9c4e0..0af553c5d 100644
--- a/krebs/3modules/buildbot/slave.nix
+++ b/krebs/3modules/buildbot/slave.nix
@@ -160,6 +160,8 @@ let
# TODO: maybe also prepare buildbot.tac?
ExecStartPre = pkgs.writeDash "buildbot-master-init" ''
set -efux
+ #remove garbage from old versions
+ rm -r ${workdir}
mkdir -p ${workdir}/info
cp ${buildbot-slave-init} ${workdir}/buildbot.tac
echo ${contact} > ${workdir}/info/admin
diff --git a/lass/2configs/pass.nix b/lass/2configs/pass.nix
index 5bd2f2f7f..43eb0db9b 100644
--- a/lass/2configs/pass.nix
+++ b/lass/2configs/pass.nix
@@ -3,7 +3,7 @@
{
krebs.per-user.lass.packages = with pkgs; [
pass
- gnupg1
+ gnupg
];
}
diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index 17c39a5f4..77790e8b8 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -73,17 +73,6 @@ in {
allowKeysForGroup = true;
group = "lasscert";
};
- certs."cgit.lassul.us" = {
- email = "lassulus@gmail.com";
- webroot = "/var/lib/acme/acme-challenges";
- plugins = [
- "account_key.json"
- "key.pem"
- "fullchain.pem"
- ];
- group = "nginx";
- allowKeysForGroup = true;
- };
};
krebs.tinc_graphs.enable = true;
@@ -119,6 +108,7 @@ in {
];
services.nginx.virtualHosts."lassul.us" = {
+ addSSL = true;
enableACME = true;
serverAliases = [ "lassul.us" ];
locations."/".extraConfig = ''
@@ -158,30 +148,14 @@ in {
in ''
alias ${initscript};
'';
-
- enableSSL = true;
- extraConfig = ''
- listen 80;
- listen [::]:80;
- '';
- sslCertificate = "/var/lib/acme/lassul.us/fullchain.pem";
- sslCertificateKey = "/var/lib/acme/lassul.us/key.pem";
};
services.nginx.virtualHosts.cgit = {
+ addSSL = true;
+ enableACME = true;
serverAliases = [
"cgit.lassul.us"
];
- locations."/.well-known/acme-challenge".extraConfig = ''
- root /var/lib/acme/acme-challenges;
- '';
- enableSSL = true;
- extraConfig = ''
- listen 80;
- listen [::]:80;
- '';
- sslCertificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
- sslCertificateKey = "/var/lib/acme/cgit.lassul.us/key.pem";
};
users.users.blog = {
diff --git a/lass/3modules/ejabberd/config.nix b/lass/3modules/ejabberd/config.nix
index b1fca08d3..68bcfa340 100644
--- a/lass/3modules/ejabberd/config.nix
+++ b/lass/3modules/ejabberd/config.nix
@@ -1,93 +1,129 @@
-{ config, ... }: with import <stockholm/lib>; let
- cfg = config.lass.ejabberd;
+with import <stockholm/lib>;
+{ config, ... }: let
- # XXX this is a placeholder that happens to work the default strings.
- toErlang = builtins.toJSON;
-in toFile "ejabberd.conf" ''
- {loglevel, 3}.
- {hosts, ${toErlang cfg.hosts}}.
- {listen,
- [
- {5222, ejabberd_c2s, [
- starttls,
- {certfile, ${toErlang cfg.certfile.path}},
- {access, c2s},
- {shaper, c2s_shaper},
- {max_stanza_size, 65536}
- ]},
- {5269, ejabberd_s2s_in, [
- {shaper, s2s_shaper},
- {max_stanza_size, 131072}
- ]},
- {5280, ejabberd_http, [
- captcha,
- http_bind,
- http_poll,
- web_admin
- ]}
- ]}.
- {s2s_use_starttls, required}.
- {s2s_certfile, ${toErlang cfg.s2s_certfile.path}}.
- {auth_method, internal}.
- {shaper, normal, {maxrate, 1000}}.
- {shaper, fast, {maxrate, 50000}}.
- {max_fsm_queue, 1000}.
- {acl, local, {user_regexp, ""}}.
- {access, max_user_sessions, [{10, all}]}.
- {access, max_user_offline_messages, [{5000, admin}, {100, all}]}.
- {access, local, [{allow, local}]}.
- {access, c2s, [{deny, blocked},
- {allow, all}]}.
- {access, c2s_shaper, [{none, admin},
- {normal, all}]}.
- {access, s2s_shaper, [{fast, all}]}.
- {access, announce, [{allow, admin}]}.
- {access, configure, [{allow, admin}]}.
- {access, muc_admin, [{allow, admin}]}.
- {access, muc_create, [{allow, local}]}.
- {access, muc, [{allow, all}]}.
- {access, pubsub_createnode, [{allow, local}]}.
- {access, register, [{allow, local}]}.
- {language, "en"}.
- {modules,
- [
- {mod_adhoc, []},
- {mod_announce, [{access, announce}]},
- {mod_blocking,[]},
- {mod_caps, []},
- {mod_configure,[]},
- {mod_disco, []},
- {mod_irc, []},
- {mod_http_bind, []},
- {mod_last, []},
- {mod_muc, [
- {access, muc},
- {access_create, muc_create},
- {access_persistent, muc_create},
- {access_admin, muc_admin}
- ]},
- {mod_offline, [{access_max_user_messages, max_user_offline_messages}]},
- {mod_ping, []},
- {mod_privacy, []},
- {mod_private, []},
- {mod_pubsub, [
- {access_createnode, pubsub_createnode},
- {ignore_pep_from_offline, true},
- {last_item_cache, false},
- {plugins, ["flat", "hometree", "pep"]}
- ]},
- {mod_register, [
- {welcome_message, {"Welcome!",
- "Hi.\nWelcome to this XMPP server."}},
- {ip_access, [{allow, "127.0.0.0/8"},
- {allow, "0.0.0.0/0"}]},
- {access, register}
- ]},
- {mod_roster, []},
- {mod_shared_roster,[]},
- {mod_stats, []},
- {mod_time, []},
- {mod_vcard, []},
- {mod_version, []}
- ]}.
+ # See https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example
+
+ ciphers = concatStringsSep ":" [
+ "ECDHE-ECDSA-AES256-GCM-SHA384"
+ "ECDHE-RSA-AES256-GCM-SHA384"
+ "ECDHE-ECDSA-CHACHA20-POLY1305"
+ "ECDHE-RSA-CHACHA20-POLY1305"
+ "ECDHE-ECDSA-AES128-GCM-SHA256"
+ "ECDHE-RSA-AES128-GCM-SHA256"
+ "ECDHE-ECDSA-AES256-SHA384"
+ "ECDHE-RSA-AES256-SHA384"
+ "ECDHE-ECDSA-AES128-SHA256"
+ "ECDHE-RSA-AES128-SHA256"
+ ];
+
+ protocol_options = [
+ "no_sslv2"
+ "no_sslv3"
+ "no_tlsv1"
+ "no_tlsv1_10"
+ ];
+
+in /* yaml */ ''
+
+ access_rules:
+ announce:
+ - allow: admin
+ local:
+ - allow: local
+ configure:
+ - allow: admin
+ register:
+ - allow
+ s2s:
+ - allow
+ trusted_network:
+ - allow: loopback
+
+ acl:
+ local:
+ user_regexp: ""
+ loopback:
+ ip:
+ - "127.0.0.0/8"
+ - "::1/128"
+ - "::FFFF:127.0.0.1/128"
+
+ hosts: ${toJSON config.hosts}
+
+ language: "en"
+
+ listen:
+ -
+ port: 5222
+ ip: "::"
+ module: ejabberd_c2s
+ shaper: c2s_shaper
+ certfile: ${toJSON config.certfile.path}
+ ciphers: ${toJSON ciphers}
+ dhfile: ${toJSON config.dhfile.path}
+ protocol_options: ${toJSON protocol_options}
+ starttls: true
+ starttls_required: true
+ tls: false
+ tls_compression: false
+ max_stanza_size: 65536
+ -
+ port: 5269
+ ip: "::"
+ module: ejabberd_s2s_in
+ shaper: s2s_shaper
+ max_stanza_size: 131072
+
+ loglevel: 4
+
+ modules:
+ mod_adhoc: {}
+ mod_admin_extra: {}
+ mod_announce:
+ access: announce
+ mod_caps: {}
+ mod_carboncopy: {}
+ mod_client_state: {}
+ mod_configure: {}
+ mod_disco: {}
+ mod_echo: {}
+ mod_irc: {}
+ mod_bosh: {}
+ mod_last: {}
+ mod_offline:
+ access_max_user_messages: max_user_offline_messages
+ mod_ping: {}
+ mod_privacy: {}
+ mod_private: {}
+ mod_register:
+ access_from: deny
+ access: register
+ ip_access: trusted_network
+ registration_watchers: ${toJSON config.registration_watchers}
+ mod_roster: {}
+ mod_shared_roster: {}
+ mod_stats: {}
+ mod_time: {}
+ mod_vcard:
+ search: false
+ mod_version: {}
+ mod_http_api: {}
+
+ s2s_access: s2s
+ s2s_certfile: ${toJSON config.s2s_certfile.path}
+ s2s_ciphers: ${toJSON ciphers}
+ s2s_dhfile: ${toJSON config.dhfile.path}
+ s2s_protocol_options: ${toJSON protocol_options}
+ s2s_tls_compression: false
+ s2s_use_starttls: required
+
+ shaper_rules:
+ max_user_offline_messages:
+ - 5000: admin
+ - 100
+ max_user_sessions: 10
+ c2s_shaper:
+ - none: admin
+ - normal
+ s2s_shaper: fast
''
diff --git a/lass/3modules/ejabberd/default.nix b/lass/3modules/ejabberd/default.nix
index e2fba5ff5..4838a9093 100644
--- a/lass/3modules/ejabberd/default.nix
+++ b/lass/3modules/ejabberd/default.nix
@@ -1,5 +1,16 @@
{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
cfg = config.lass.ejabberd;
+
+ gen-dhparam = pkgs.writeDash "gen-dhparam" ''
+ set -efu
+ path=$1
+ bits=2048
+ # TODO regenerate dhfile after some time?
+ if ! test -e "$path"; then
+ ${pkgs.openssl}/bin/openssl dhparam "$bits" > "$path"
+ fi
+ '';
+
in {
options.lass.ejabberd = {
enable = mkEnableOption "lass.ejabberd";
@@ -11,20 +22,36 @@ in {
source-path = "/var/lib/acme/lassul.us/full.pem";
};
};
+ dhfile = mkOption {
+ type = types.secret-file;
+ default = {
+ path = "${cfg.user.home}/dhparams.pem";
+ owner = cfg.user;
+ source-path = "/dev/null";
+ };
+ };
hosts = mkOption {
type = with types; listOf str;
};
pkgs.ejabberdctl = mkOption {
type = types.package;
default = pkgs.writeDashBin "ejabberdctl" ''
- set -efu
- export SPOOLDIR=${shell.escape cfg.user.home}
- export EJABBERD_CONFIG_PATH=${shell.escape (import ./config.nix args)}
exec ${pkgs.ejabberd}/bin/ejabberdctl \
+ --config ${toFile "ejabberd.yaml" (import ./config.nix {
+ inherit pkgs;
+ config = cfg;
+ })} \
--logs ${shell.escape cfg.user.home} \
+ --spool ${shell.escape cfg.user.home} \
"$@"
'';
};
+ registration_watchers = mkOption {
+ type = types.listOf types.str;
+ default = [
+ config.krebs.users.tv.mail
+ ];
+ };
s2s_certfile = mkOption {
type = types.secret-file;
default = cfg.certfile;
@@ -50,12 +77,12 @@ in {
requires = [ "secret.service" ];
after = [ "network.target" "secret.service" ];
serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = "yes";
- PermissionsStartOnly = "true";
+ ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
+ ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground";
+ PermissionsStartOnly = true;
SyslogIdentifier = "ejabberd";
User = cfg.user.name;
- ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl start";
+ TimeoutStartSec = 60;
};
};
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 16:00:34 +0000