mirror of
https://github.com/ilyakooo0/nixpkgs.git
synced 2024-09-11 07:15:54 +03:00
nixos/endlessh-go: init module
This commit is contained in:
parent
3576b67eb1
commit
99dc9b9c16
@ -239,6 +239,13 @@
|
|||||||
<link linkend="opt-services.alps.enable">services.alps</link>.
|
<link linkend="opt-services.alps.enable">services.alps</link>.
|
||||||
</para>
|
</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
<link xlink:href="https://github.com/shizunge/endlessh-go">endlessh-go</link>,
|
||||||
|
an SSH tarpit that exposes Prometheus metrics. Available as
|
||||||
|
<link linkend="opt-services.endlessh-go.enable">services.endlessh-go</link>.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>
|
<para>
|
||||||
<link xlink:href="https://netbird.io">netbird</link>, a zero
|
<link xlink:href="https://netbird.io">netbird</link>, a zero
|
||||||
|
@ -87,6 +87,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||||||
|
|
||||||
- [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
|
- [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
|
||||||
|
|
||||||
|
- [endlessh-go](https://github.com/shizunge/endlessh-go), an SSH tarpit that exposes Prometheus metrics. Available as [services.endlessh-go](#opt-services.endlessh-go.enable).
|
||||||
|
|
||||||
- [netbird](https://netbird.io), a zero configuration VPN.
|
- [netbird](https://netbird.io), a zero configuration VPN.
|
||||||
Available as [services.netbird](options.html#opt-services.netbird.enable).
|
Available as [services.netbird](options.html#opt-services.netbird.enable).
|
||||||
|
|
||||||
|
@ -1000,6 +1000,7 @@
|
|||||||
./services/security/certmgr.nix
|
./services/security/certmgr.nix
|
||||||
./services/security/cfssl.nix
|
./services/security/cfssl.nix
|
||||||
./services/security/clamav.nix
|
./services/security/clamav.nix
|
||||||
|
./services/security/endlessh-go.nix
|
||||||
./services/security/fail2ban.nix
|
./services/security/fail2ban.nix
|
||||||
./services/security/fprintd.nix
|
./services/security/fprintd.nix
|
||||||
./services/security/haka.nix
|
./services/security/haka.nix
|
||||||
|
138
nixos/modules/services/security/endlessh-go.nix
Normal file
138
nixos/modules/services/security/endlessh-go.nix
Normal file
@ -0,0 +1,138 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.endlessh-go;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.services.endlessh-go = {
|
||||||
|
enable = mkEnableOption (mdDoc "endlessh-go service");
|
||||||
|
|
||||||
|
listenAddress = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "0.0.0.0";
|
||||||
|
example = "[::]";
|
||||||
|
description = mdDoc ''
|
||||||
|
Interface address to bind the endlessh-go daemon to SSH connections.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
port = mkOption {
|
||||||
|
type = types.port;
|
||||||
|
default = 2222;
|
||||||
|
example = 22;
|
||||||
|
description = mdDoc ''
|
||||||
|
Specifies on which port the endlessh-go daemon listens for SSH
|
||||||
|
connections.
|
||||||
|
|
||||||
|
Setting this to `22` may conflict with {option}`services.openssh`.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
prometheus = {
|
||||||
|
enable = mkEnableOption (mdDoc "Prometheus integration");
|
||||||
|
|
||||||
|
listenAddress = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "0.0.0.0";
|
||||||
|
example = "[::]";
|
||||||
|
description = mdDoc ''
|
||||||
|
Interface address to bind the endlessh-go daemon to answer Prometheus
|
||||||
|
queries.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
port = mkOption {
|
||||||
|
type = types.port;
|
||||||
|
default = 2112;
|
||||||
|
example = 9119;
|
||||||
|
description = mdDoc ''
|
||||||
|
Specifies on which port the endlessh-go daemon listens for Prometheus
|
||||||
|
queries.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
extraOptions = mkOption {
|
||||||
|
type = with types; listOf str;
|
||||||
|
default = [ ];
|
||||||
|
example = [ "-conn_type=tcp4" "-max_clients=8192" ];
|
||||||
|
description = mdDoc ''
|
||||||
|
Additional command line options to pass to the endlessh-go daemon.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
openFirewall = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Whether to open a firewall port for the SSH listener.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
systemd.services.endlessh-go = {
|
||||||
|
description = "SSH tarpit";
|
||||||
|
requires = [ "network.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
serviceConfig =
|
||||||
|
let
|
||||||
|
needsPrivileges = cfg.port < 1024 || cfg.prometheus.port < 1024;
|
||||||
|
capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
|
||||||
|
rootDirectory = "/run/endlessh-go";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
Restart = "always";
|
||||||
|
ExecStart = with cfg; concatStringsSep " " ([
|
||||||
|
"${pkgs.endlessh-go}/bin/endlessh-go"
|
||||||
|
"-logtostderr"
|
||||||
|
"-host=${listenAddress}"
|
||||||
|
"-port=${toString port}"
|
||||||
|
] ++ optionals prometheus.enable [
|
||||||
|
"-enable_prometheus"
|
||||||
|
"-prometheus_host=${prometheus.listenAddress}"
|
||||||
|
"-prometheus_port=${toString prometheus.port}"
|
||||||
|
] ++ extraOptions);
|
||||||
|
DynamicUser = true;
|
||||||
|
RootDirectory = rootDirectory;
|
||||||
|
BindReadOnlyPaths = [ builtins.storeDir ];
|
||||||
|
InaccessiblePaths = [ "-+${rootDirectory}" ];
|
||||||
|
RuntimeDirectory = baseNameOf rootDirectory;
|
||||||
|
RuntimeDirectoryMode = "700";
|
||||||
|
AmbientCapabilities = capabilities;
|
||||||
|
CapabilityBoundingSet = capabilities;
|
||||||
|
UMask = "0077";
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateUsers = !needsPrivileges;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
ProtectProc = "noaccess";
|
||||||
|
ProcSubset = "pid";
|
||||||
|
RemoveIPC = true;
|
||||||
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = with cfg;
|
||||||
|
optionals openFirewall [ port prometheus.port ];
|
||||||
|
};
|
||||||
|
|
||||||
|
meta.maintainers = with maintainers; [ azahi ];
|
||||||
|
}
|
@ -142,6 +142,7 @@ in {
|
|||||||
ejabberd = handleTest ./xmpp/ejabberd.nix {};
|
ejabberd = handleTest ./xmpp/ejabberd.nix {};
|
||||||
elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
|
elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
|
||||||
emacs-daemon = handleTest ./emacs-daemon.nix {};
|
emacs-daemon = handleTest ./emacs-daemon.nix {};
|
||||||
|
endlessh-go = handleTest ./endlessh-go.nix {};
|
||||||
engelsystem = handleTest ./engelsystem.nix {};
|
engelsystem = handleTest ./engelsystem.nix {};
|
||||||
enlightenment = handleTest ./enlightenment.nix {};
|
enlightenment = handleTest ./enlightenment.nix {};
|
||||||
env = handleTest ./env.nix {};
|
env = handleTest ./env.nix {};
|
||||||
|
58
nixos/tests/endlessh-go.nix
Normal file
58
nixos/tests/endlessh-go.nix
Normal file
@ -0,0 +1,58 @@
|
|||||||
|
import ./make-test-python.nix ({ lib, pkgs, ... }:
|
||||||
|
{
|
||||||
|
name = "endlessh-go";
|
||||||
|
meta.maintainers = with lib.maintainers; [ azahi ];
|
||||||
|
|
||||||
|
nodes = {
|
||||||
|
server = { ... }: {
|
||||||
|
services.endlessh-go = {
|
||||||
|
enable = true;
|
||||||
|
prometheus.enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
specialisation = {
|
||||||
|
unprivileged.configuration = {
|
||||||
|
services.endlessh-go = {
|
||||||
|
port = 2222;
|
||||||
|
prometheus.port = 9229;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
privileged.configuration = {
|
||||||
|
services.endlessh-go = {
|
||||||
|
port = 22;
|
||||||
|
prometheus.port = 92;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
client = { pkgs, ... }: {
|
||||||
|
environment.systemPackages = with pkgs; [ curl netcat ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
testScript = ''
|
||||||
|
def activate_specialisation(name: str):
|
||||||
|
server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
|
||||||
|
|
||||||
|
start_all()
|
||||||
|
|
||||||
|
with subtest("Unprivileged"):
|
||||||
|
activate_specialisation("unprivileged")
|
||||||
|
server.wait_for_unit("endlessh-go.service")
|
||||||
|
server.wait_for_open_port(2222)
|
||||||
|
server.wait_for_open_port(9229)
|
||||||
|
client.succeed("nc -dvW5 server 2222")
|
||||||
|
client.succeed("curl -kv server:9229/metrics")
|
||||||
|
|
||||||
|
with subtest("Privileged"):
|
||||||
|
activate_specialisation("privileged")
|
||||||
|
server.wait_for_unit("endlessh-go.service")
|
||||||
|
server.wait_for_open_port(22)
|
||||||
|
server.wait_for_open_port(92)
|
||||||
|
client.succeed("nc -dvW5 server 22")
|
||||||
|
client.succeed("curl -kv server:92/metrics")
|
||||||
|
'';
|
||||||
|
})
|
@ -1,6 +1,7 @@
|
|||||||
{ lib
|
{ lib
|
||||||
, buildGoModule
|
, buildGoModule
|
||||||
, fetchFromGitHub
|
, fetchFromGitHub
|
||||||
|
, nixosTests
|
||||||
}:
|
}:
|
||||||
|
|
||||||
buildGoModule rec {
|
buildGoModule rec {
|
||||||
@ -18,6 +19,8 @@ buildGoModule rec {
|
|||||||
|
|
||||||
ldflags = [ "-s" "-w" ];
|
ldflags = [ "-s" "-w" ];
|
||||||
|
|
||||||
|
passthru.tests = nixosTests.endlessh-go;
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
description = "An implementation of endlessh exporting Prometheus metrics";
|
description = "An implementation of endlessh exporting Prometheus metrics";
|
||||||
homepage = "https://github.com/shizunge/endlessh-go";
|
homepage = "https://github.com/shizunge/endlessh-go";
|
||||||
|
Loading…
Reference in New Issue
Block a user