111 lines
2.9 KiB
Nix
111 lines
2.9 KiB
Nix
{
|
|
lib,
|
|
pkgs,
|
|
config,
|
|
...
|
|
}:
|
|
# CVE-2021-44512: fixed in master branch
|
|
# CVE-2021-44513: fixed in master branch
|
|
# Introduces compatability with tmate client in NixOS
|
|
#
|
|
# TODO:
|
|
# Add options for all the variables
|
|
# Configure websockets
|
|
# Deploy web UI from tmate-master repo
|
|
with lib; let
|
|
tmate-ssh-server = pkgs.tmate-ssh-server.overrideAttrs (
|
|
old: {
|
|
src = pkgs.fetchFromGitHub {
|
|
owner = "tmate-io";
|
|
repo = "tmate-ssh-server";
|
|
rev = "1f314123df2bb29cb07427ed8663a81c8d9034fd";
|
|
sha256 = "sha256-9/xlMvtkNWUBRYYnJx20qEgtEcjagH2NtEKZcDOM1BY=";
|
|
};
|
|
version = "master";
|
|
}
|
|
);
|
|
cfg = config.services.tmate;
|
|
in {
|
|
options.services.tmate = {
|
|
enable = mkEnableOption "tmate service";
|
|
sshHostname = mkOption {
|
|
type = types.str;
|
|
default = "localhost";
|
|
description = ''
|
|
configures the SSH hostname to advertise to tmate hosts
|
|
'';
|
|
};
|
|
sshPortListen = mkOption {
|
|
type = types.port;
|
|
default = 2200;
|
|
description = ''
|
|
port on which the SSH server should listen
|
|
'';
|
|
};
|
|
sshKeysPath = mkOption {
|
|
type = types.str;
|
|
default = "${cfg.tmateHome}/keys";
|
|
description = ''
|
|
path where the ssh keys are located (mandatory)
|
|
'';
|
|
};
|
|
openFirewall = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
fix me
|
|
'';
|
|
};
|
|
tmateHome = mkOption {
|
|
type = types.str;
|
|
default = "/var/lib/tmate";
|
|
description = ''
|
|
tmate service working directory
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
networking.firewall = {
|
|
allowedTCPPorts = mkIf cfg.openFirewall [
|
|
cfg.sshPortListen
|
|
];
|
|
};
|
|
systemd.services.tmate = {
|
|
path = [pkgs.openssh];
|
|
preStart = ''
|
|
gen_key() {
|
|
keytype=$1
|
|
ks=$keytype"_"
|
|
key="${cfg.sshKeysPath}/ssh_host_"$ks"key"
|
|
if [ ! -e $key ] ; then
|
|
ssh-keygen -t $keytype -f $key -N ""
|
|
echo ""
|
|
fi
|
|
SIG=$(ssh-keygen -l -E SHA256 -f "$key.pub" | cut -d ' ' -f 2)
|
|
}
|
|
|
|
mkdir -p '${cfg.sshKeysPath}'
|
|
gen_key rsa
|
|
RSA_SIG=$SIG
|
|
gen_key ed25519
|
|
ED25519_SIG=$SIG
|
|
|
|
{
|
|
echo "set -g tmate-server-host ${cfg.sshHostname}"
|
|
echo "set -g tmate-server-port ${toString cfg.sshPortListen}"
|
|
echo "set -g tmate-server-rsa-fingerprint $RSA_SIG"
|
|
echo "set -g tmate-server-ed25519-fingerprint $ED25519_SIG"
|
|
} > '${cfg.tmateHome}/tmate.conf'
|
|
echo 'Copy ${cfg.tmateHome}/tmate.conf to ~/.tmate.conf to connect clients to this server'
|
|
'';
|
|
wants = ["network-online.target"];
|
|
wantedBy = ["multi-user.target"];
|
|
serviceConfig = {
|
|
ExecStart = "${tmate-ssh-server}/bin/tmate-ssh-server -k ${cfg.sshKeysPath} -p ${toString cfg.sshPortListen} -h ${cfg.sshHostname}";
|
|
WorkingDirectory = cfg.tmateHome;
|
|
};
|
|
};
|
|
};
|
|
}
|