WIP: temmie/userweb: run log processors as separate systemd units
Eval nix flake / evals (push) Successful in 9m24s
Eval nix flake / evals (push) Successful in 9m24s
This lets us divide up some of the logic making httpd itself less brittle, and also reduces the amount of privileges for httpd.
This commit is contained in:
@@ -14,8 +14,6 @@ let
|
||||
upload_max_filesize = "40M";
|
||||
});
|
||||
|
||||
apache-log-processor = pkgs.callPackage ./apache-log-processor { };
|
||||
|
||||
# https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
|
||||
phpEnv = pkgs.php.buildEnv {
|
||||
extensions = { all, ... }: with all; [
|
||||
@@ -163,11 +161,6 @@ in
|
||||
./mail.nix
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"httpd/passwd-ssh-key" = { };
|
||||
"httpd/ssh-known-hosts" = { };
|
||||
};
|
||||
|
||||
services.httpd = {
|
||||
enable = true;
|
||||
adminAddr = "drift@pvv.ntnu.no";
|
||||
@@ -237,8 +230,8 @@ in
|
||||
|
||||
extraConfig = ''
|
||||
CustomLog "${cfg.logDir}/access.log" combined
|
||||
CustomLog "|${lib.getExe apache-log-processor} access" combined
|
||||
ErrorLog "|${lib.getExe apache-log-processor} error"
|
||||
CustomLog "/run/httpd-log-processor-access.fifo" combined
|
||||
ErrorLog "/run/httpd-log-processor-error.fifo"
|
||||
ScriptLog "${cfg.logDir}/cgi.log"
|
||||
|
||||
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
|
||||
@@ -308,64 +301,17 @@ in
|
||||
|
||||
serviceConfig = {
|
||||
Type = lib.mkForce "notify";
|
||||
|
||||
ExecStartPre = let
|
||||
rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
|
||||
in lib.mkForce [
|
||||
"${lib.getExe (pkgs.writeShellApplication {
|
||||
name = "http-exec-start-pre-remove-old-semaphores";
|
||||
text = ''
|
||||
# Get rid of old semaphores. These tend to accumulate across
|
||||
# server restarts, eventually preventing it from restarting
|
||||
# successfully.
|
||||
for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
|
||||
${pkgs.util-linux}/bin/ipcrm -s "$i"
|
||||
done
|
||||
'';
|
||||
})}"
|
||||
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-in/"
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-in/"
|
||||
|
||||
(let
|
||||
args = lib.cli.toCommandLineShellGNU { } {
|
||||
passwd-file = "/run/httpd/pamunix-in/passwd";
|
||||
group-file = "/run/httpd/pamunix-in/group";
|
||||
output-dir = "/run/httpd/pamunix-out";
|
||||
shadow-file = pkgs.emptyFile;
|
||||
|
||||
output-passwd = true;
|
||||
|
||||
ignore-user-file = toString ./ignore_user_file.txt;
|
||||
ignore-group-file = toString ./ignore_group_file.txt;
|
||||
};
|
||||
in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
|
||||
"${lib.getExe' pkgs.coreutils "shred"} -u /run/httpd/pamunix-in/passwd /run/httpd/pamunix-in/group"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' /run/httpd/pamunix-out/group"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' /run/httpd/pamunix-out/group"
|
||||
"+${lib.getExe' pkgs.coreutils "chown"} root:root /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
|
||||
"+${lib.getExe' pkgs.coreutils "chmod"} 0644 /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
|
||||
"+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/passwd /etc/passwd"
|
||||
"+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/group /etc/group"
|
||||
];
|
||||
ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
|
||||
ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
|
||||
ExecStop = lib.mkForce "";
|
||||
KillMode = "mixed";
|
||||
|
||||
LoadCredential=[
|
||||
"sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
|
||||
"ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
|
||||
];
|
||||
|
||||
ConfigurationDirectory = [ "httpd" ];
|
||||
LogsDirectory = [ "httpd" ];
|
||||
LogsDirectoryMode = "0700";
|
||||
|
||||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
|
||||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
|
||||
LockPersonality = !debug;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
@@ -393,48 +339,19 @@ in
|
||||
"tcp:443"
|
||||
];
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = lib.mkIf (!debug) [
|
||||
"@system-service"
|
||||
"@setuid"
|
||||
];
|
||||
SystemCallFilter = lib.mkIf (!debug) [ "@system-service" ];
|
||||
UMask = "0077";
|
||||
|
||||
RuntimeDirectoryMode = "0750";
|
||||
RuntimeDirectory = [
|
||||
"httpd/root-mnt"
|
||||
"httpd/pamunix-in"
|
||||
"httpd/pamunix-out"
|
||||
];
|
||||
RuntimeDirectory = [ "httpd/root-mnt" ];
|
||||
RootDirectory = "/run/httpd/root-mnt";
|
||||
MountAPIVFS = true;
|
||||
BindReadOnlyPaths = [
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
"/dev/null"
|
||||
"/etc/resolv.conf"
|
||||
"/var/lib/acme"
|
||||
|
||||
"-/run/httpd/pamunix-out/passwd:/etc/passwd"
|
||||
"-/run/httpd/pamunix-out/group:/etc/group"
|
||||
|
||||
"${pkgs.writeText "userweb-fake-nsswitch.conf" ''
|
||||
passwd: files
|
||||
group: files
|
||||
shadow: files
|
||||
sudoers: files
|
||||
|
||||
hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns
|
||||
networks: files
|
||||
|
||||
ethers: files
|
||||
services: files
|
||||
protocols: files
|
||||
rpc: files
|
||||
|
||||
subuid: files
|
||||
subgid: files
|
||||
''}:/etc/nsswitch.conf"
|
||||
|
||||
"/var/run/nscd"
|
||||
"${fhsEnv}/bin:/bin"
|
||||
"${fhsEnv}/sbin:/sbin"
|
||||
"${fhsEnv}/lib:/lib"
|
||||
|
||||
@@ -0,0 +1,135 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
|
||||
|
||||
apache-log-processor = pkgs.callPackage ./apache-log-processor { };
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"httpd/passwd-ssh-key" = { };
|
||||
"httpd/ssh-known-hosts" = { };
|
||||
};
|
||||
|
||||
systemd.targets.sockets.wants = [
|
||||
"httpd-log-processor@access.socket"
|
||||
"httpd-log-processor@error.socket"
|
||||
];
|
||||
|
||||
systemd.sockets."httpd-log-processor@" = lib.mkIf config.services.httpd.enable {
|
||||
socketConfig = {
|
||||
ListenFIFO = "/run/httpd-log-processor-%i.fifo";
|
||||
SocketUser = "httpd";
|
||||
SocketGroup = "httpd";
|
||||
SocketMode = "0600";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."httpd-log-processor@" = lib.mkIf config.services.httpd.enable {
|
||||
serviceConfig = {
|
||||
User = "httpd";
|
||||
Group = "httpd";
|
||||
|
||||
LoadCredential = [
|
||||
"sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
|
||||
"ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
|
||||
];
|
||||
ExecStartPre = let
|
||||
rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
|
||||
inputDir = "/run/httpd-log-processor-%i/pamunix-in";
|
||||
outputDir = "/run/httpd-log-processor-%i/pamunix-out";
|
||||
in lib.mkForce [
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd ${inputDir}/"
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group ${inputDir}/"
|
||||
|
||||
(let
|
||||
args = lib.cli.toCommandLineShellGNU { } {
|
||||
passwd-file = "${inputDir}/passwd";
|
||||
group-file = "${inputDir}/group";
|
||||
output-dir = outputDir;
|
||||
shadow-file = pkgs.emptyFile;
|
||||
|
||||
output-passwd = true;
|
||||
|
||||
ignore-user-file = toString ./ignore_user_file.txt;
|
||||
ignore-group-file = toString ./ignore_group_file.txt;
|
||||
};
|
||||
in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
|
||||
"${lib.getExe' pkgs.coreutils "shred"} -u ${inputDir}/passwd ${inputDir}/group"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' ${outputDir}/passwd"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' ${outputDir}/passwd"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' ${outputDir}/group"
|
||||
":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' ${outputDir}/group"
|
||||
"+${lib.getExe' pkgs.coreutils "chown"} root:root ${outputDir}/passwd ${outputDir}/group"
|
||||
"+${lib.getExe' pkgs.coreutils "chmod"} 0644 ${outputDir}/passwd ${outputDir}/group"
|
||||
"+${lib.getExe pkgs.mount} --bind ${outputDir}/passwd /etc/passwd"
|
||||
"+${lib.getExe pkgs.mount} --bind ${outputDir}/group /etc/group"
|
||||
];
|
||||
|
||||
ExecStart = "${lib.getExe apache-log-processor} %i";
|
||||
|
||||
AmbientCapabilities = [ "CAP_SETUID" "CAP_SETGID" ];
|
||||
CapabilityBoundingSet = [ "CAP_SETUID" "CAP_SETGID" ];
|
||||
LockPersonality = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
PrivateNetworking = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = "tmpfs";
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectSystem = true;
|
||||
RemoveIPC = true;
|
||||
# RestrictAddressFamilies = [ "AF_UNIX" ];
|
||||
RestrictAddressFamilies = [ "" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SocketBindDeny = "any";
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"@setuid"
|
||||
];
|
||||
UMask = "0077";
|
||||
|
||||
RootDirectory = "/run/httpd-log-processor-%i/root-mnt";
|
||||
MountAPIVFS = true;
|
||||
|
||||
RuntimeDirectoryMode = "0750";
|
||||
RuntimeDirectory = [
|
||||
"httpd-log-processo4-%i/root-mnt"
|
||||
"httpd-log-processo4-%i/pamunix-in"
|
||||
"httpd-log-processo4-%i/pamunix-out"
|
||||
];
|
||||
BindReadOnlyPaths = [
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
"/dev/null"
|
||||
|
||||
"-/run/httpd-log-processor-%i/pamunix-out/passwd:/etc/passwd"
|
||||
"-/run/httpd-log-processor-%i/pamunix-out/group:/etc/group"
|
||||
|
||||
"${pkgs.writeText "userweb-fake-nsswitch.conf" ''
|
||||
passwd: files
|
||||
group: files
|
||||
shadow: files
|
||||
sudoers: files
|
||||
|
||||
hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns
|
||||
networks: files
|
||||
|
||||
ethers: files
|
||||
services: files
|
||||
protocols: files
|
||||
rpc: files
|
||||
|
||||
subuid: files
|
||||
subgid: files
|
||||
''}:/etc/nsswitch.conf"
|
||||
];
|
||||
BindPaths = map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") homeLetters;
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user