summaryrefslogtreecommitdiffstats
path: root/tv/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'tv/3modules')
-rw-r--r--tv/3modules/charybdis/config.nix4
-rw-r--r--tv/3modules/charybdis/default.nix46
-rw-r--r--tv/3modules/ejabberd/config.nix9
-rw-r--r--tv/3modules/ejabberd/default.nix52
-rw-r--r--tv/3modules/x0vncserver.nix28
5 files changed, 49 insertions, 90 deletions
diff --git a/tv/3modules/charybdis/config.nix b/tv/3modules/charybdis/config.nix
index 3c73d256..dccbfde6 100644
--- a/tv/3modules/charybdis/config.nix
+++ b/tv/3modules/charybdis/config.nix
@@ -61,13 +61,13 @@ in toFile "charybdis.conf" ''
vhost6 = ${toJSON config.krebs.build.host.nets.retiolum.ip6.addr};
/* ssl_private_key: our ssl private key */
- ssl_private_key = ${toJSON cfg.ssl_private_key.path};
+ ssl_private_key = "/tmp/credentials/ssl_private_key";
/* ssl_cert: certificate for our ssl server */
ssl_cert = ${toJSON cfg.ssl_cert};
/* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */
- ssl_dh_params = ${toJSON cfg.ssl_dh_params.path};
+ ssl_dh_params = "/tmp/credentials/ssl_dh_params";
/* ssld_count: number of ssld processes you want to start, if you
* have a really busy server, using N-1 where N is the number of
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
index 9c5ce273..96aae702 100644
--- a/tv/3modules/charybdis/default.nix
+++ b/tv/3modules/charybdis/default.nix
@@ -15,22 +15,12 @@ in {
type = types.path;
};
ssl_dh_params = mkOption {
- type = types.secret-file;
- default = {
- name = "charybdis-ssl_dh_params";
- path = "${cfg.user.home}/dh.pem";
- owner = cfg.user;
- source-path = toString <secrets> + "/charybdis.dh.pem";
- };
+ type = types.absolute-pathname;
+ default = toString <secrets> + "/charybdis.dh.pem";
};
ssl_private_key = mkOption {
- type = types.secret-file;
- default = {
- name = "charybdis-ssl_private_key";
- path = "${cfg.user.home}/ssl.key.pem";
- owner = cfg.user;
- source-path = toString <secrets> + "/charybdis.key.pem";
- };
+ type = types.absolute-pathname;
+ default = toString <secrets> + "/charybdis.key.pem";
};
sslport = mkOption {
type = types.int;
@@ -46,22 +36,13 @@ in {
};
config = lib.mkIf cfg.enable {
- krebs.secret.files.charybdis-ssl_dh_params = cfg.ssl_dh_params;
- krebs.secret.files.charybdis-ssl_private_key = cfg.ssl_private_key;
-
environment.etc."charybdis-ircd.motd".text = cfg.motd;
+ krebs.systemd.services.charybdis = {};
+
systemd.services.charybdis = {
wantedBy = [ "multi-user.target" ];
- after = [
- config.krebs.secret.files.charybdis-ssl_dh_params.service
- config.krebs.secret.files.charybdis-ssl_private_key.service
- "network-online.target"
- ];
- partOf = [
- config.krebs.secret.files.charybdis-ssl_dh_params.service
- config.krebs.secret.files.charybdis-ssl_private_key.service
- ];
+ after = [ "network-online.target" ];
environment = {
BANDB_DBPATH = "${cfg.user.home}/ban.db";
};
@@ -70,21 +51,30 @@ in {
User = cfg.user.name;
PrivateTmp = true;
Restart = "always";
- ExecStartPre =
- "${pkgs.coreutils}/bin/ln -s /etc/charybdis-ircd.motd /tmp/ircd.motd";
+ ExecStartPre = [
+ "${pkgs.coreutils}/bin/ln -s /etc/charybdis-ircd.motd /tmp/ircd.motd"
+ "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials"
+ ];
ExecStart = toString [
"${pkgs.charybdis}/bin/charybdis"
"-configfile ${import ./config.nix args}"
"-foreground"
"-logfile /dev/stderr"
];
+ LoadCredential = [
+ "ssl_dh_params:${cfg.ssl_dh_params}"
+ "ssl_private_key:${cfg.ssl_private_key}"
+ ];
};
};
users.users.${cfg.user.name} = {
inherit (cfg.user) home name uid;
createHome = true;
+ group = cfg.user.name;
isSystemUser = true;
};
+
+ users.groups.${cfg.user.name} = {};
};
}
diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix
index a0631e22..a022bc44 100644
--- a/tv/3modules/ejabberd/config.nix
+++ b/tv/3modules/ejabberd/config.nix
@@ -48,6 +48,9 @@ in /* yaml */ ''
- "::1/128"
- "::FFFF:127.0.0.1/128"
+ certfiles:
+ - /tmp/credentials/certfile
+
hosts: ${toJSON config.hosts}
language: "en"
@@ -58,9 +61,8 @@ in /* yaml */ ''
ip: "::"
module: ejabberd_c2s
shaper: c2s_shaper
- certfile: ${toJSON config.certfile.path}
ciphers: ${toJSON ciphers}
- dhfile: ${toJSON config.dhfile.path}
+ dhfile: /var/lib/ejabberd/dhfile
protocol_options: ${toJSON protocol_options}
starttls: true
starttls_required: true
@@ -109,9 +111,8 @@ in /* yaml */ ''
mod_http_api: {}
s2s_access: s2s
- s2s_certfile: ${toJSON config.s2s_certfile.path}
s2s_ciphers: ${toJSON ciphers}
- s2s_dhfile: ${toJSON config.dhfile.path}
+ s2s_dhfile: /var/lib/ejabberd/dhfile
s2s_protocol_options: ${toJSON protocol_options}
s2s_tls_compression: false
s2s_use_starttls: required
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
index 2ca88732..935df9a9 100644
--- a/tv/3modules/ejabberd/default.nix
+++ b/tv/3modules/ejabberd/default.nix
@@ -16,22 +16,8 @@ in {
options.tv.ejabberd = {
enable = mkEnableOption "tv.ejabberd";
certfile = mkOption {
- type = types.secret-file;
- default = {
- name = "ejabberd-certfile";
- path = "${cfg.user.home}/ejabberd.pem";
- owner = cfg.user;
- source-path = toString <secrets> + "/ejabberd.pem";
- };
- };
- dhfile = mkOption {
- type = types.secret-file;
- default = {
- name = "ejabberd-dhfile";
- path = "${cfg.user.home}/dhparams.pem";
- owner = cfg.user;
- source-path = "/dev/null";
- };
+ type = types.absolute-pathname;
+ default = toString <secrets> + "/ejabberd.pem";
};
hosts = mkOption {
type = with types; listOf str;
@@ -61,10 +47,6 @@ in {
config.krebs.users.tv.mail
];
};
- s2s_certfile = mkOption {
- type = types.secret-file;
- default = cfg.certfile;
- };
user = mkOption {
type = types.user;
default = {
@@ -90,27 +72,24 @@ in {
})
];
- krebs.secret.files = {
- ejabberd-certfile = cfg.certfile;
- ejabberd-s2s_certfile = cfg.s2s_certfile;
- };
+ krebs.systemd.services.ejabberd = {};
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
- after = [
- config.krebs.secret.files.ejabberd-certfile.service
- config.krebs.secret.files.ejabberd-s2s_certfile.service
- "network.target"
- ];
- partOf = [
- config.krebs.secret.files.ejabberd-certfile.service
- config.krebs.secret.files.ejabberd-s2s_certfile.service
- ];
+ after = [ "network.target" ];
serviceConfig = {
- ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
- ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";
+ ExecStart = pkgs.writeDash "ejabberd" ''
+ ${pkgs.coreutils}/bin/ln -s "$CREDENTIALS_DIRECTORY" /tmp/credentials
+ ${gen-dhparam} /var/lib/ejabberd/dhfile
+ exec ${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground
+ '';
+ LoadCredential = [
+ "certfile:${cfg.certfile}"
+ ];
PermissionsStartOnly = true;
+ PrivateTmp = true;
SyslogIdentifier = "ejabberd";
+ StateDirectory = "ejabberd";
User = cfg.user.name;
TimeoutStartSec = 60;
};
@@ -119,7 +98,10 @@ in {
users.users.${cfg.user.name} = {
inherit (cfg.user) home name uid;
createHome = true;
+ group = cfg.user.name;
isSystemUser = true;
};
+
+ users.groups.${cfg.user.name} = {};
};
}
diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix
index ba79c4a4..4dbb34df 100644
--- a/tv/3modules/x0vncserver.nix
+++ b/tv/3modules/x0vncserver.nix
@@ -11,17 +11,12 @@ in {
};
enable = mkEnableOption "tv.x0vncserver";
pwfile = mkOption {
- default = {
- name = "x0vncserver-pwfile";
- owner = cfg.user;
- path = "${cfg.user.home}/.vncpasswd";
- source-path = toString <secrets> + "/vncpasswd";
- };
+ default = toString <secrets> + "/vncpasswd";
description = ''
Use vncpasswd to edit pwfile.
See: nix-shell -p tigervnc --run 'man vncpasswd'
'';
- type = types.secret-file;
+ type = types.absolute-pathname;
};
rfbport = mkOption {
default = 5900;
@@ -33,26 +28,17 @@ in {
};
};
config = mkIf cfg.enable {
- krebs.secret.files = {
- x0vncserver-pwfile = cfg.pwfile;
- };
+ krebs.systemd.services.x0vncserver = {};
systemd.services.x0vncserver = {
- after = [
- config.krebs.secret.files.x0vncserver-pwfile.service
- "graphical.target"
- ];
- partOf = [
- config.krebs.secret.files.x0vncserver-pwfile.service
- ];
- requires = [
- "graphical.target"
- ];
+ after = [ "graphical.target" ];
+ requires = [ "graphical.target" ];
serviceConfig = {
ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
"-display ${cfg.display}"
- "-passwordfile ${cfg.pwfile.path}"
+ "-passwordfile \${CREDENTIALS_DIRECTORY}/pwfile"
"-rfbport ${toString cfg.rfbport}"
]}";
+ LoadCredential = "ssh_key:${cfg.pwfile}";
User = cfg.user.name;
};
};
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-29 18:29:37 +0000