pyrox.dev
1{ config, pkgs, lib, ... }:
2
3with lib;
4
5let
6 cfg = config.services.teleport;
7 settingsYaml = pkgs.formats.yaml { };
8in
9{
10 options = {
11 services.teleport = with lib.types; {
12 enable = mkEnableOption (lib.mdDoc "the Teleport service");
13
14 package = mkOption {
15 type = types.package;
16 default = pkgs.teleport;
17 defaultText = lib.literalMD "pkgs.teleport";
18 example = lib.literalMD "pkgs.teleport_11";
19 description = lib.mdDoc "The teleport package to use";
20 };
21
22 settings = mkOption {
23 type = settingsYaml.type;
24 default = { };
25 example = literalExpression ''
26 {
27 teleport = {
28 nodename = "client";
29 advertise_ip = "192.168.1.2";
30 auth_token = "60bdc117-8ff4-478d-95e4-9914597847eb";
31 auth_servers = [ "192.168.1.1:3025" ];
32 log.severity = "DEBUG";
33 };
34 ssh_service = {
35 enabled = true;
36 labels = {
37 role = "client";
38 };
39 };
40 proxy_service.enabled = false;
41 auth_service.enabled = false;
42 }
43 '';
44 description = lib.mdDoc ''
45 Contents of the `teleport.yaml` config file.
46 The `--config` arguments will only be passed if this set is not empty.
47
48 See <https://goteleport.com/docs/setup/reference/config/>.
49 '';
50 };
51
52 insecure.enable = mkEnableOption (lib.mdDoc ''
53 starting teleport in insecure mode.
54
55 This is dangerous!
56 Sensitive information will be logged to console and certificates will not be verified.
57 Proceed with caution!
58
59 Teleport starts with disabled certificate validation on Proxy Service, validation still occurs on Auth Service
60 '');
61
62 diag = {
63 enable = mkEnableOption (lib.mdDoc ''
64 endpoints for monitoring purposes.
65
66 See <https://goteleport.com/docs/setup/admin/troubleshooting/#troubleshooting/>
67 '');
68
69 addr = mkOption {
70 type = str;
71 default = "127.0.0.1";
72 description = lib.mdDoc "Metrics and diagnostics address.";
73 };
74
75 port = mkOption {
76 type = port;
77 default = 3000;
78 description = lib.mdDoc "Metrics and diagnostics port.";
79 };
80 };
81 };
82 };
83
84 config = mkIf config.services.teleport.enable {
85 environment.systemPackages = [ cfg.package ];
86
87 systemd.services.teleport = {
88 wantedBy = [ "multi-user.target" ];
89 after = [ "network.target" ];
90 serviceConfig = {
91 ExecStart = ''
92 ${cfg.package}/bin/teleport start \
93 ${optionalString cfg.insecure.enable "--insecure"} \
94 ${optionalString cfg.diag.enable "--diag-addr=${cfg.diag.addr}:${toString cfg.diag.port}"} \
95 ${optionalString (cfg.settings != { }) "--config=${settingsYaml.generate "teleport.yaml" cfg.settings}"}
96 '';
97 ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
98 LimitNOFILE = 65536;
99 Restart = "always";
100 RestartSec = "5s";
101 RuntimeDirectory = "teleport";
102 Type = "simple";
103 };
104 };
105 };
106}
107