Skip to content
Snippets Groups Projects
Commit de5f454b authored by Florian Sesser's avatar Florian Sesser
Browse files

Merge branch 'develop' into 341.monitoring-vpn

parents 610a591e 5e67f8a4
No related branches found
No related tags found
3 merge requests!101Merge staging into production,!100Merge develop into staging,!87Add monitoring VPN modules and config
Pipeline #686 failed
...@@ -4,7 +4,7 @@ ...@@ -4,7 +4,7 @@
, "monitoringvpnKeyDir": "./secrets/monitoringvpn" , "monitoringvpnKeyDir": "./secrets/monitoringvpn"
, "monitoringvpnEndpoint": "192.168.67.24:51820" , "monitoringvpnEndpoint": "192.168.67.24:51820"
, "passValue": 1000000 , "passValue": 1000000
, "issuerDomain": "payments.localdev" , "issuerDomains": ["payments.localdev"]
, "letsEncryptAdminEmail": "florian@privatestorage.io" , "letsEncryptAdminEmail": "florian@privatestorage.io"
, "allowedChargeOrigins": [ , "allowedChargeOrigins": [
"http://localhost:5000" "http://localhost:5000"
......
...@@ -2,7 +2,10 @@ ...@@ -2,7 +2,10 @@
, "ristrettoSigningKeyPath": "./secrets/ristretto.signing-key" , "ristrettoSigningKeyPath": "./secrets/ristretto.signing-key"
, "stripeSecretKeyPath": "./secrets/stripe.secret" , "stripeSecretKeyPath": "./secrets/stripe.secret"
, "passValue": 1000000 , "passValue": 1000000
, "issuerDomain": "payments.privatestorage.io" , "issuerDomains": [
"payments.privatestorage.io"
, "payments.private.storage"
]
, "letsEncryptAdminEmail": "jean-paul@privatestorage.io" , "letsEncryptAdminEmail": "jean-paul@privatestorage.io"
, "allowedChargeOrigins": [ , "allowedChargeOrigins": [
"https://privatestorage.io" "https://privatestorage.io"
......
...@@ -2,7 +2,10 @@ ...@@ -2,7 +2,10 @@
, "ristrettoSigningKeyPath": "./secrets/ristretto.signing-key" , "ristrettoSigningKeyPath": "./secrets/ristretto.signing-key"
, "stripeSecretKeyPath": "./secrets/stripe.secret" , "stripeSecretKeyPath": "./secrets/stripe.secret"
, "passValue": 1000000 , "passValue": 1000000
, "issuerDomain": "payments.privatestorage-staging.com" , "issuerDomains": [
"payments.privatestorage-staging.com"
, "payments.extra.privatestorage-staging.com"
]
, "letsEncryptAdminEmail": "jean-paul@privatestorage.io" , "letsEncryptAdminEmail": "jean-paul@privatestorage.io"
, "allowedChargeOrigins": [ , "allowedChargeOrigins": [
"http://localhost:5000" "http://localhost:5000"
......
{ hardware { hardware
, ristrettoSigningKeyPath , ristrettoSigningKeyPath
, stripeSecretKeyPath , stripeSecretKeyPath
, issuerDomain , issuerDomains
, letsEncryptAdminEmail , letsEncryptAdminEmail
, allowedChargeOrigins , allowedChargeOrigins
, sshUsers , sshUsers
...@@ -75,7 +75,7 @@ in rec { ...@@ -75,7 +75,7 @@ in rec {
database = "SQLite3"; database = "SQLite3";
databasePath = "/var/db/vouchers.sqlite3"; databasePath = "/var/db/vouchers.sqlite3";
inherit letsEncryptAdminEmail; inherit letsEncryptAdminEmail;
domain = issuerDomain; domains = issuerDomains;
inherit allowedChargeOrigins; inherit allowedChargeOrigins;
}; };
......
...@@ -18,12 +18,11 @@ in { ...@@ -18,12 +18,11 @@ in {
The package to use for the ZKAP issuer. The package to use for the ZKAP issuer.
''; '';
}; };
services.private-storage-issuer.domain = lib.mkOption { services.private-storage-issuer.domains = lib.mkOption {
default = "payments.privatestorage.io"; type = lib.types.listOf lib.types.str;
type = lib.types.str; example = lib.literalExample [ "payments.example.com" ];
example = lib.literalExample "payments.example.com";
description = '' description = ''
The domain name at which the issuer is reachable. The domain names at which the issuer is reachable.
''; '';
}; };
services.private-storage-issuer.tls = lib.mkOption { services.private-storage-issuer.tls = lib.mkOption {
...@@ -115,6 +114,10 @@ in { ...@@ -115,6 +114,10 @@ in {
config = config =
let let
certroot = "/var/lib/letsencrypt/live"; certroot = "/var/lib/letsencrypt/live";
# We'll refer to this collection of domains by the first domain in the
# list.
domain = builtins.head cfg.domains;
certServiceName = "cert-${domain}";
in lib.mkIf cfg.enable { in lib.mkIf cfg.enable {
# Add a systemd service to run PaymentServer. # Add a systemd service to run PaymentServer.
systemd.services.zkapissuer = { systemd.services.zkapissuer = {
...@@ -124,7 +127,7 @@ in { ...@@ -124,7 +127,7 @@ in {
# Make sure we have a certificate the first time, if we are running over # Make sure we have a certificate the first time, if we are running over
# TLS and require a certificate. # TLS and require a certificate.
requires = lib.optional cfg.tls "cert-${cfg.domain}.service"; requires = lib.optional cfg.tls "${certServiceName}.service";
after = [ after = [
# Make sure there is a network so we can bind to all of the # Make sure there is a network so we can bind to all of the
...@@ -133,7 +136,7 @@ in { ...@@ -133,7 +136,7 @@ in {
] ++ ] ++
# Make sure we run after the certificate is issued, if we are running # Make sure we run after the certificate is issued, if we are running
# over TLS and require a certificate. # over TLS and require a certificate.
lib.optional cfg.tls "cert-${cfg.domain}.service"; lib.optional cfg.tls "${certServiceName}.service";
# It really shouldn't ever exit on its own! If it does, it's a bug # It really shouldn't ever exit on its own! If it does, it's a bug
# we'll have to fix. Restart it and hope it doesn't happen too much # we'll have to fix. Restart it and hope it doesn't happen too much
...@@ -157,9 +160,9 @@ in { ...@@ -157,9 +160,9 @@ in {
if cfg.tls if cfg.tls
then then
"--https-port 443 " + "--https-port 443 " +
"--https-certificate-path ${certroot}/${cfg.domain}/cert.pem " + "--https-certificate-path ${certroot}/${domain}/cert.pem " +
"--https-certificate-chain-path ${certroot}/${cfg.domain}/chain.pem " + "--https-certificate-chain-path ${certroot}/${domain}/chain.pem " +
"--https-key-path ${certroot}/${cfg.domain}/privkey.pem" "--https-key-path ${certroot}/${domain}/privkey.pem"
else else
# Only for automated testing. # Only for automated testing.
"--http-port 80"; "--http-port 80";
...@@ -179,20 +182,20 @@ in { ...@@ -179,20 +182,20 @@ in {
# Certificate renewal. We must declare that we *require* it in our # Certificate renewal. We must declare that we *require* it in our
# service above. # service above.
systemd.services."cert-${cfg.domain}" = { systemd.services."${certServiceName}" = {
enable = true; enable = true;
description = "Issue/Renew certificate for ${cfg.domain}"; description = "Certificate ${domain}";
serviceConfig = { serviceConfig = {
ExecStart = ExecStart =
let let
configArgs = "--config-dir /var/lib/letsencrypt --work-dir /var/run/letsencrypt --logs-dir /var/run/log/letsencrypt"; configArgs = "--config-dir /var/lib/letsencrypt --work-dir /var/run/letsencrypt --logs-dir /var/run/log/letsencrypt";
in in
pkgs.writeScript "cert-${cfg.domain}-start.sh" '' pkgs.writeScript "cert-${domain}-start.sh" ''
#!${pkgs.runtimeShell} -e #!${pkgs.runtimeShell} -e
# Register if necessary. # Register if necessary.
${pkgs.certbot}/bin/certbot register ${configArgs} --non-interactive --agree-tos -m ${cfg.letsEncryptAdminEmail} || true ${pkgs.certbot}/bin/certbot register ${configArgs} --non-interactive --agree-tos -m ${cfg.letsEncryptAdminEmail} || true
# Obtain the certificate. # Obtain the certificate.
${pkgs.certbot}/bin/certbot certonly ${configArgs} --non-interactive --standalone --domains ${cfg.domain} ${pkgs.certbot}/bin/certbot certonly ${configArgs} --non-interactive --standalone --expand --domains ${builtins.concatStringsSep "," cfg.domains}
''; '';
}; };
}; };
......
...@@ -37,6 +37,10 @@ ...@@ -37,6 +37,10 @@
# password-based authentication at all. # password-based authentication at all.
PermitEmptyPasswords no PermitEmptyPasswords no
# Agent forwarding is fraught. It can be used by an attacker to
# leverage one compromised system into more. Discourage its use.
AllowAgentForwarding no
# Only allow authentication as one of the configured users, not random # Only allow authentication as one of the configured users, not random
# other (often system-managed) users. Possibly this is also # other (often system-managed) users. Possibly this is also
# superfluous! NixOS system users have nologin as their shell ... so they # superfluous! NixOS system users have nologin as their shell ... so they
......
...@@ -134,7 +134,7 @@ in { ...@@ -134,7 +134,7 @@ in {
services.private-storage-issuer = { services.private-storage-issuer = {
enable = true; enable = true;
domain = "issuer"; domains = ["issuer"];
tls = false; tls = false;
issuer = "Ristretto"; issuer = "Ristretto";
inherit ristrettoSigningKeyPath; inherit ristrettoSigningKeyPath;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment