pvv-nixos-config/modules/wackattack-ctf-stockfish/default.nix

109 lines
2.9 KiB
Nix

{ config, pkgs, lib, ... }: let
stockfish = with pkgs.python3Packages; buildPythonPackage rec {
pname = "stockfish";
version = "3.28.0";
disabled = pythonOlder "3.7";
src = pkgs.fetchFromGitHub {
owner = "zhelyabuzhsky";
repo = pname;
rev = version;
hash = "sha256-XLgVjLV2QXeTYPjP/lwc0LH850LKJsymFlrAMkAn8HU=";
};
format = "setuptools";
nativeBuildInputs = [
setuptools
];
propagatedBuildInputs = [
pytest-runner
];
doCheck = false;
};
inputimeout = with pkgs.python3Packages; buildPythonPackage rec {
pname = "inputimeout";
version = "1.0.4";
src = pkgs.fetchFromGitHub {
owner = "johejo";
repo = pname;
rev = "v${version}";
hash = "sha256-Fh1CaqJOK58nURt4imkhCmZKG2eJlP/Hi10SarUJ+Fs=";
};
format = "setuptools";
nativeBuildInputs = [ setuptools ];
doCheck = false;
};
script = pkgs.writers.writePython3 "chess" {
libraries = [
stockfish
inputimeout
];
# Fy!
flakeIgnore = [ "F403" "F405" "E231" "E265" "E302" "E305" "E501" "E722" ];
} (builtins.replaceStrings [''path="./stockfish"''] [''path="${pkgs.stockfish}/bin/stockfish"''] (builtins.readFile ./chess.py));
in
{
sops.secrets."keys/wackattack_ctf/flag" = { };
systemd.sockets."wackattack-ctf-stockfish" = {
description = "Save some azure credit for the rest of us";
partOf = [ "wackattack-ctf-stockfish.service" ];
wantedBy = [ "sockets.target" ];
socketConfig = {
ListenStream = "0.0.0.0:9999";
Accept = true;
};
};
systemd.services."wackattack-ctf-stockfish@" = {
description = "Save some azure credit for the rest of us";
after = [ "network.target" ];
requires = [ "wackattack-ctf-stockfish.socket" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
DynamicUser = true;
WorkingDirectory = "%d";
Restart = "always";
StandardInput = "socket";
LoadCredential = "flag.txt:${config.sops.secrets."keys/wackattack_ctf/flag".path}";
Exec = script;
# systemd hardening go barr
ProcSubset = "pid";
ProtectProc = "invisible";
AmbientCapabilities = "";
CapabilityBoundingSet = "";
NoNewPrivileges = true;
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
LockPersonality = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
SystemCallArchitectures = "native";
};
};
}