pyrox.dev
1{ config, pkgs, lib, options, ... }:
2
3let
4 cfg = config.services.firefox-syncserver;
5 opt = options.services.firefox-syncserver;
6 defaultDatabase = "firefox_syncserver";
7 defaultUser = "firefox-syncserver";
8
9 dbIsLocal = cfg.database.host == "localhost";
10 dbURL = "mysql://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}";
11
12 format = pkgs.formats.toml {};
13 settings = {
14 human_logs = true;
15 syncstorage = {
16 database_url = dbURL;
17 };
18 tokenserver = {
19 node_type = "mysql";
20 database_url = dbURL;
21 fxa_email_domain = "api.accounts.firefox.com";
22 fxa_oauth_server_url = "https://oauth.accounts.firefox.com/v1";
23 run_migrations = true;
24 # if JWK caching is not enabled the token server must verify tokens
25 # using the fxa api, on a thread pool with a static size.
26 additional_blocking_threads_for_fxa_requests = 10;
27 } // lib.optionalAttrs cfg.singleNode.enable {
28 # Single-node mode is likely to be used on small instances with little
29 # capacity. The default value (0.1) can only ever release capacity when
30 # accounts are removed if the total capacity is 10 or larger to begin
31 # with.
32 # https://github.com/mozilla-services/syncstorage-rs/issues/1313#issuecomment-1145293375
33 node_capacity_release_rate = 1;
34 };
35 };
36 configFile = format.generate "syncstorage.toml" (lib.recursiveUpdate settings cfg.settings);
37 setupScript = pkgs.writeShellScript "firefox-syncserver-setup" ''
38 set -euo pipefail
39 shopt -s inherit_errexit
40
41 schema_configured() {
42 mysql ${cfg.database.name} -Ne 'SHOW TABLES' | grep -q services
43 }
44
45 update_config() {
46 mysql ${cfg.database.name} <<"EOF"
47 BEGIN;
48
49 INSERT INTO `services` (`id`, `service`, `pattern`)
50 VALUES (1, 'sync-1.5', '{node}/1.5/{uid}')
51 ON DUPLICATE KEY UPDATE service='sync-1.5', pattern='{node}/1.5/{uid}';
52 INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
53 `capacity`, `downed`, `backoff`)
54 VALUES (1, 1, '${cfg.singleNode.url}', ${toString cfg.singleNode.capacity},
55 0, ${toString cfg.singleNode.capacity}, 0, 0)
56 ON DUPLICATE KEY UPDATE node = '${cfg.singleNode.url}', capacity=${toString cfg.singleNode.capacity};
57
58 COMMIT;
59 EOF
60 }
61
62
63 for (( try = 0; try < 60; try++ )); do
64 if ! schema_configured; then
65 sleep 2
66 else
67 update_config
68 exit 0
69 fi
70 done
71
72 echo "Single-node setup failed"
73 exit 1
74 '';
75in
76
77{
78 options = {
79 services.firefox-syncserver = {
80 enable = lib.mkEnableOption (lib.mdDoc ''
81 the Firefox Sync storage service.
82
83 Out of the box this will not be very useful unless you also configure at least
84 one service and one nodes by inserting them into the mysql database manually, e.g.
85 by running
86
87 ```
88 INSERT INTO `services` (`id`, `service`, `pattern`) VALUES ('1', 'sync-1.5', '{node}/1.5/{uid}');
89 INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
90 `capacity`, `downed`, `backoff`)
91 VALUES ('1', '1', 'https://mydomain.tld', '1', '0', '10', '0', '0');
92 ```
93
94 {option}`${opt.singleNode.enable}` does this automatically when enabled
95 '');
96
97 package = lib.mkOption {
98 type = lib.types.package;
99 default = pkgs.syncstorage-rs;
100 defaultText = lib.literalExpression "pkgs.syncstorage-rs";
101 description = lib.mdDoc ''
102 Package to use.
103 '';
104 };
105
106 database.name = lib.mkOption {
107 # the mysql module does not allow `-quoting without resorting to shell
108 # escaping, so we restrict db names for forward compaitiblity should this
109 # behavior ever change.
110 type = lib.types.strMatching "[a-z_][a-z0-9_]*";
111 default = defaultDatabase;
112 description = lib.mdDoc ''
113 Database to use for storage. Will be created automatically if it does not exist
114 and `config.${opt.database.createLocally}` is set.
115 '';
116 };
117
118 database.user = lib.mkOption {
119 type = lib.types.str;
120 default = defaultUser;
121 description = lib.mdDoc ''
122 Username for database connections.
123 '';
124 };
125
126 database.host = lib.mkOption {
127 type = lib.types.str;
128 default = "localhost";
129 description = lib.mdDoc ''
130 Database host name. `localhost` is treated specially and inserts
131 systemd dependencies, other hostnames or IP addresses of the local machine do not.
132 '';
133 };
134
135 database.createLocally = lib.mkOption {
136 type = lib.types.bool;
137 default = true;
138 description = lib.mdDoc ''
139 Whether to create database and user on the local machine if they do not exist.
140 This includes enabling unix domain socket authentication for the configured user.
141 '';
142 };
143
144 logLevel = lib.mkOption {
145 type = lib.types.str;
146 default = "error";
147 description = lib.mdDoc ''
148 Log level to run with. This can be a simple log level like `error`
149 or `trace`, or a more complicated logging expression.
150 '';
151 };
152
153 secrets = lib.mkOption {
154 type = lib.types.path;
155 description = lib.mdDoc ''
156 A file containing the various secrets. Should be in the format expected by systemd's
157 `EnvironmentFile` directory. Two secrets are currently available:
158 `SYNC_MASTER_SECRET` and
159 `SYNC_TOKENSERVER__FXA_METRICS_HASH_SECRET`.
160 '';
161 };
162
163 singleNode = {
164 enable = lib.mkEnableOption (lib.mdDoc "auto-configuration for a simple single-node setup");
165
166 enableTLS = lib.mkEnableOption (lib.mdDoc "automatic TLS setup");
167
168 enableNginx = lib.mkEnableOption (lib.mdDoc "nginx virtualhost definitions");
169
170 hostname = lib.mkOption {
171 type = lib.types.str;
172 description = lib.mdDoc ''
173 Host name to use for this service.
174 '';
175 };
176
177 capacity = lib.mkOption {
178 type = lib.types.ints.unsigned;
179 default = 10;
180 description = lib.mdDoc ''
181 How many sync accounts are allowed on this server. Setting this value
182 equal to or less than the number of currently active accounts will
183 effectively deny service to accounts not yet registered here.
184 '';
185 };
186
187 url = lib.mkOption {
188 type = lib.types.str;
189 default = "${if cfg.singleNode.enableTLS then "https" else "http"}://${cfg.singleNode.hostname}";
190 defaultText = lib.literalExpression ''
191 ''${if cfg.singleNode.enableTLS then "https" else "http"}://''${config.${opt.singleNode.hostname}}
192 '';
193 description = lib.mdDoc ''
194 URL of the host. If you are not using the automatic webserver proxy setup you will have
195 to change this setting or your sync server may not be functional.
196 '';
197 };
198 };
199
200 settings = lib.mkOption {
201 type = lib.types.submodule {
202 freeformType = format.type;
203
204 options = {
205 port = lib.mkOption {
206 type = lib.types.port;
207 default = 5000;
208 description = lib.mdDoc ''
209 Port to bind to.
210 '';
211 };
212
213 tokenserver.enabled = lib.mkOption {
214 type = lib.types.bool;
215 default = true;
216 description = lib.mdDoc ''
217 Whether to enable the token service as well.
218 '';
219 };
220 };
221 };
222 default = { };
223 description = lib.mdDoc ''
224 Settings for the sync server. These take priority over values computed
225 from NixOS options.
226
227 See the doc comments on the `Settings` structs in
228 <https://github.com/mozilla-services/syncstorage-rs/blob/master/syncstorage/src/settings.rs>
229 and
230 <https://github.com/mozilla-services/syncstorage-rs/blob/master/syncstorage/src/tokenserver/settings.rs>
231 for available options.
232 '';
233 };
234 };
235 };
236
237 config = lib.mkIf cfg.enable {
238 services.mysql = lib.mkIf cfg.database.createLocally {
239 enable = true;
240 ensureDatabases = [ cfg.database.name ];
241 ensureUsers = [{
242 name = cfg.database.user;
243 ensurePermissions = {
244 "${cfg.database.name}.*" = "all privileges";
245 };
246 }];
247 };
248
249 systemd.services.firefox-syncserver = {
250 wantedBy = [ "multi-user.target" ];
251 requires = lib.mkIf dbIsLocal [ "mysql.service" ];
252 after = lib.mkIf dbIsLocal [ "mysql.service" ];
253 restartTriggers = lib.optional cfg.singleNode.enable setupScript;
254 environment.RUST_LOG = cfg.logLevel;
255 serviceConfig = {
256 User = defaultUser;
257 Group = defaultUser;
258 ExecStart = "${cfg.package}/bin/syncserver --config ${configFile}";
259 EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}";
260
261 # hardening
262 RemoveIPC = true;
263 CapabilityBoundingSet = [ "" ];
264 DynamicUser = true;
265 NoNewPrivileges = true;
266 PrivateDevices = true;
267 ProtectClock = true;
268 ProtectKernelLogs = true;
269 ProtectControlGroups = true;
270 ProtectKernelModules = true;
271 SystemCallArchitectures = "native";
272 # syncstorage-rs uses python-cffi internally, and python-cffi does not
273 # work with MemoryDenyWriteExecute=true
274 MemoryDenyWriteExecute = false;
275 RestrictNamespaces = true;
276 RestrictSUIDSGID = true;
277 ProtectHostname = true;
278 LockPersonality = true;
279 ProtectKernelTunables = true;
280 RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
281 RestrictRealtime = true;
282 ProtectSystem = "strict";
283 ProtectProc = "invisible";
284 ProcSubset = "pid";
285 ProtectHome = true;
286 PrivateUsers = true;
287 PrivateTmp = true;
288 SystemCallFilter = [ "@system-service" "~ @privileged @resources" ];
289 UMask = "0077";
290 };
291 };
292
293 systemd.services.firefox-syncserver-setup = lib.mkIf cfg.singleNode.enable {
294 wantedBy = [ "firefox-syncserver.service" ];
295 requires = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
296 after = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
297 path = [ config.services.mysql.package ];
298 serviceConfig.ExecStart = [ "${setupScript}" ];
299 };
300
301 services.nginx.virtualHosts = lib.mkIf cfg.singleNode.enableNginx {
302 ${cfg.singleNode.hostname} = {
303 enableACME = cfg.singleNode.enableTLS;
304 forceSSL = cfg.singleNode.enableTLS;
305 locations."/" = {
306 proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
307 # We need to pass the Host header that matches the original Host header. Otherwise,
308 # Hawk authentication will fail (because it assumes that the client and server see
309 # the same value of the Host header).
310 recommendedProxySettings = true;
311 };
312 };
313 };
314 };
315
316 meta = {
317 maintainers = with lib.maintainers; [ pennae ];
318 doc = ./firefox-syncserver.md;
319 };
320}