tmux: initial deployment
This commit is contained in:
parent
4745c4f5f7
commit
85a6ed66bb
|
@ -1,17 +1,19 @@
|
|||
# NixOps configuration for toscano
|
||||
#
|
||||
# https://en.wikipedia.org/wiki/Joseph_Toscano
|
||||
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
../networks/linode.nix
|
||||
../profiles/gitea.nix
|
||||
../profiles/hakyll-skeleton.nix
|
||||
../profiles/jfdic-web.nix
|
||||
../profiles/resrok-web.nix
|
||||
../profiles/tmateServer.nix
|
||||
../profiles/voc-web.nix
|
||||
../secrets/gitea.nix
|
||||
];
|
||||
|
|
146
modules/tmate-ssh-server.nix
Normal file
146
modules/tmate-ssh-server.nix
Normal file
|
@ -0,0 +1,146 @@
|
|||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
# CVE-2021-44512: fixed in master branch
|
||||
# CVE-2021-44513: fixed in master branch
|
||||
# Introduces compatability with tmate client in NixOS
|
||||
#
|
||||
# TODO:
|
||||
# Add options for all the variables
|
||||
# Configure websockets
|
||||
# Deploy web UI from tmate-master repo
|
||||
with lib; let
|
||||
tmate-ssh-server = pkgs.tmate-ssh-server.overrideAttrs (
|
||||
old: {
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "tmate-io";
|
||||
repo = "tmate-ssh-server";
|
||||
rev = "1f314123df2bb29cb07427ed8663a81c8d9034fd";
|
||||
sha256 = "sha256-9/xlMvtkNWUBRYYnJx20qEgtEcjagH2NtEKZcDOM1BY=";
|
||||
};
|
||||
version = "master";
|
||||
}
|
||||
);
|
||||
cfg = config.services.tmate;
|
||||
in {
|
||||
options.services.tmate = {
|
||||
enable = mkEnableOption "tmate service";
|
||||
sshHostname = mkOption {
|
||||
type = types.str;
|
||||
default = "localhost";
|
||||
description = ''
|
||||
configures the SSH hostname to advertise to tmate hosts
|
||||
'';
|
||||
};
|
||||
sshPortListen = mkOption {
|
||||
type = types.port;
|
||||
default = 2200;
|
||||
description = ''
|
||||
port on which the SSH server should listen
|
||||
'';
|
||||
};
|
||||
sshKeysPath = mkOption {
|
||||
type = types.str;
|
||||
default = "${cfg.dataDir}/keys";
|
||||
description = ''
|
||||
path where the ssh keys are located (mandatory)
|
||||
'';
|
||||
};
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
fix me
|
||||
'';
|
||||
};
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/tmate";
|
||||
example = "/var/lib/tmate";
|
||||
description = ''
|
||||
tmate service working directory
|
||||
'';
|
||||
};
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "root";
|
||||
description = ''
|
||||
User account under which the tmate service runs
|
||||
'';
|
||||
};
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "root";
|
||||
description = ''
|
||||
Group under which the tmate service runs.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = mkIf cfg.openFirewall [
|
||||
cfg.sshPortListen
|
||||
];
|
||||
};
|
||||
systemd.services.tmate = {
|
||||
path = [pkgs.openssh];
|
||||
#execStart = ''
|
||||
# mkdir -p '${cfg.sshKeysPath}'
|
||||
# chmod 0600 '${cfg.dataDir}'
|
||||
#'';
|
||||
preStart = ''
|
||||
gen_key() {
|
||||
keytype=$1
|
||||
ks=$keytype"_"
|
||||
key="${cfg.sshKeysPath}/ssh_host_"$ks"key"
|
||||
if [ ! -e $key ] ; then
|
||||
ssh-keygen -t $keytype -f $key -N ""
|
||||
echo ""
|
||||
fi
|
||||
SIG=$(ssh-keygen -l -E SHA256 -f "$key.pub" | cut -d ' ' -f 2)
|
||||
}
|
||||
|
||||
mkdir -p '${cfg.sshKeysPath}'
|
||||
gen_key rsa
|
||||
RSA_SIG=$SIG
|
||||
gen_key ed25519
|
||||
ED25519_SIG=$SIG
|
||||
|
||||
{
|
||||
echo "set -g tmate-server-host ${cfg.sshHostname}"
|
||||
echo "set -g tmate-server-port ${toString cfg.sshPortListen}"
|
||||
echo "set -g tmate-server-rsa-fingerprint $RSA_SIG"
|
||||
echo "set -g tmate-server-ed25519-fingerprint $ED25519_SIG"
|
||||
} > '${cfg.dataDir}/tmate.conf'
|
||||
echo 'Copy ${cfg.dataDir}/tmate.conf to ~/.tmate.conf to connect clients to this server'
|
||||
'';
|
||||
wants = ["network-online.target"];
|
||||
wantedBy = ["multi-user.target"];
|
||||
serviceConfig = {
|
||||
ExecStart = "${tmate-ssh-server}/bin/tmate-ssh-server -k ${cfg.sshKeysPath} -p ${toString cfg.sshPortListen} -h ${cfg.sshHostname}";
|
||||
WorkingDirectory = cfg.dataDir;
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
};
|
||||
};
|
||||
users = {
|
||||
users.tmate = {
|
||||
description = "tmate service";
|
||||
group = "tmate";
|
||||
isSystemUser = true;
|
||||
home = "${cfg.dataDir}";
|
||||
createHome = true;
|
||||
};
|
||||
groups = {
|
||||
tmate = {};
|
||||
};
|
||||
};
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"tmate-ssh-server-master"
|
||||
];
|
||||
};
|
||||
}
|
8
profiles/tmateServer.nix
Normal file
8
profiles/tmateServer.nix
Normal file
|
@ -0,0 +1,8 @@
|
|||
{config, ...}: {
|
||||
imports = [../modules/tmate-ssh-server.nix];
|
||||
services.tmate = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
sshHostname = "tmate.jfdic.org";
|
||||
};
|
||||
}
|
Loading…
Reference in a new issue