pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 format = pkgs.formats.yaml {};
7in
8{
9 options.services.pomerium = {
10 enable = mkEnableOption "the Pomerium authenticating reverse proxy";
11
12 configFile = mkOption {
13 type = with types; nullOr path;
14 default = null;
15 description = "Path to Pomerium config YAML. If set, overrides services.pomerium.settings.";
16 };
17
18 useACMEHost = mkOption {
19 type = with types; nullOr str;
20 default = null;
21 description = ''
22 If set, use a NixOS-generated ACME certificate with the specified name.
23
24 Note that this will require you to use a non-HTTP-based challenge, or
25 disable Pomerium's in-built HTTP redirect server by setting
26 http_redirect_addr to null and use a different HTTP server for serving
27 the challenge response.
28
29 If you're using an HTTP-based challenge, you should use the
30 Pomerium-native autocert option instead.
31 '';
32 };
33
34 settings = mkOption {
35 description = ''
36 The contents of Pomerium's config.yaml, in Nix expressions.
37
38 Specifying configFile will override this in its entirety.
39
40 See <link xlink:href="https://pomerium.io/reference/">the Pomerium
41 configuration reference</link> for more information about what to put
42 here.
43 '';
44 default = {};
45 type = format.type;
46 };
47
48 secretsFile = mkOption {
49 type = with types; nullOr path;
50 default = null;
51 description = ''
52 Path to file containing secrets for Pomerium, in systemd
53 EnvironmentFile format. See the systemd.exec(5) man page.
54 '';
55 };
56 };
57
58 config = let
59 cfg = config.services.pomerium;
60 cfgFile = if cfg.configFile != null then cfg.configFile else (format.generate "pomerium.yaml" cfg.settings);
61 in mkIf cfg.enable ({
62 systemd.services.pomerium = {
63 description = "Pomerium authenticating reverse proxy";
64 wants = [ "network.target" ] ++ (optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target");
65 after = [ "network.target" ] ++ (optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target");
66 wantedBy = [ "multi-user.target" ];
67 environment = optionalAttrs (cfg.useACMEHost != null) {
68 CERTIFICATE_FILE = "fullchain.pem";
69 CERTIFICATE_KEY_FILE = "key.pem";
70 };
71 startLimitIntervalSec = 60;
72
73 serviceConfig = {
74 DynamicUser = true;
75 StateDirectory = [ "pomerium" ];
76 ExecStart = "${pkgs.pomerium}/bin/pomerium -config ${cfgFile}";
77
78 PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
79 MemoryDenyWriteExecute = false; # breaks LuaJIT
80
81 NoNewPrivileges = true;
82 PrivateTmp = true;
83 PrivateDevices = true;
84 DevicePolicy = "closed";
85 ProtectSystem = "strict";
86 ProtectHome = true;
87 ProtectControlGroups = true;
88 ProtectKernelModules = true;
89 ProtectKernelTunables = true;
90 ProtectKernelLogs = true;
91 RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
92 RestrictNamespaces = true;
93 RestrictRealtime = true;
94 RestrictSUIDSGID = true;
95 LockPersonality = true;
96 SystemCallArchitectures = "native";
97
98 EnvironmentFile = cfg.secretsFile;
99 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
100 CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
101
102 WorkingDirectory = mkIf (cfg.useACMEHost != null) "$CREDENTIALS_DIRECTORY";
103 LoadCredential = optionals (cfg.useACMEHost != null) [
104 "fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
105 "key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
106 ];
107 };
108 };
109
110 # postRun hooks on cert renew can't be used to restart Nginx since renewal
111 # runs as the unprivileged acme user. sslTargets are added to wantedBy + before
112 # which allows the acme-finished-$cert.target to signify the successful updating
113 # of certs end-to-end.
114 systemd.services.pomerium-config-reload = mkIf (cfg.useACMEHost != null) {
115 # TODO(lukegb): figure out how to make config reloading work with credentials.
116
117 wantedBy = [ "acme-finished-${cfg.useACMEHost}.target" "multi-user.target" ];
118 # Before the finished targets, after the renew services.
119 before = [ "acme-finished-${cfg.useACMEHost}.target" ];
120 after = [ "acme-${cfg.useACMEHost}.service" ];
121 # Block reloading if not all certs exist yet.
122 unitConfig.ConditionPathExists = [ "${config.security.acme.certs.${cfg.useACMEHost}.directory}/fullchain.pem" ];
123 serviceConfig = {
124 Type = "oneshot";
125 TimeoutSec = 60;
126 ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active pomerium.service";
127 ExecStart = "/run/current-system/systemd/bin/systemctl restart pomerium.service";
128 };
129 };
130 });
131}