pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 format = pkgs.formats.yaml {};
7in
8{
9 options.services.pomerium = {
10 enable = mkEnableOption (lib.mdDoc "the Pomerium authenticating reverse proxy");
11
12 configFile = mkOption {
13 type = with types; nullOr path;
14 default = null;
15 description = lib.mdDoc "Path to Pomerium config YAML. If set, overrides services.pomerium.settings.";
16 };
17
18 useACMEHost = mkOption {
19 type = with types; nullOr str;
20 default = null;
21 description = lib.mdDoc ''
22 If set, use a NixOS-generated ACME certificate with the specified name.
23
24 Note that this will require you to use a non-HTTP-based challenge, or
25 disable Pomerium's in-built HTTP redirect server by setting
26 http_redirect_addr to null and use a different HTTP server for serving
27 the challenge response.
28
29 If you're using an HTTP-based challenge, you should use the
30 Pomerium-native autocert option instead.
31 '';
32 };
33
34 settings = mkOption {
35 description = lib.mdDoc ''
36 The contents of Pomerium's config.yaml, in Nix expressions.
37
38 Specifying configFile will override this in its entirety.
39
40 See [the Pomerium
41 configuration reference](https://pomerium.io/reference/) for more information about what to put
42 here.
43 '';
44 default = {};
45 type = format.type;
46 };
47
48 secretsFile = mkOption {
49 type = with types; nullOr path;
50 default = null;
51 description = lib.mdDoc ''
52 Path to file containing secrets for Pomerium, in systemd
53 EnvironmentFile format. See the systemd.exec(5) man page.
54 '';
55 };
56 };
57
58 config = let
59 cfg = config.services.pomerium;
60 cfgFile = if cfg.configFile != null then cfg.configFile else (format.generate "pomerium.yaml" cfg.settings);
61 in mkIf cfg.enable ({
62 systemd.services.pomerium = {
63 description = "Pomerium authenticating reverse proxy";
64 wants = [ "network.target" ] ++ (optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target");
65 after = [ "network.target" ] ++ (optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target");
66 wantedBy = [ "multi-user.target" ];
67 environment = optionalAttrs (cfg.useACMEHost != null) {
68 CERTIFICATE_FILE = "fullchain.pem";
69 CERTIFICATE_KEY_FILE = "key.pem";
70 };
71 startLimitIntervalSec = 60;
72 script = ''
73 if [[ -v CREDENTIALS_DIRECTORY ]]; then
74 cd "$CREDENTIALS_DIRECTORY"
75 fi
76 exec "${pkgs.pomerium}/bin/pomerium" -config "${cfgFile}"
77 '';
78
79 serviceConfig = {
80 DynamicUser = true;
81 StateDirectory = [ "pomerium" ];
82
83 PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
84 MemoryDenyWriteExecute = false; # breaks LuaJIT
85
86 NoNewPrivileges = true;
87 PrivateTmp = true;
88 PrivateDevices = true;
89 DevicePolicy = "closed";
90 ProtectSystem = "strict";
91 ProtectHome = true;
92 ProtectControlGroups = true;
93 ProtectKernelModules = true;
94 ProtectKernelTunables = true;
95 ProtectKernelLogs = true;
96 RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
97 RestrictNamespaces = true;
98 RestrictRealtime = true;
99 RestrictSUIDSGID = true;
100 LockPersonality = true;
101 SystemCallArchitectures = "native";
102
103 EnvironmentFile = cfg.secretsFile;
104 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
105 CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
106
107 LoadCredential = optionals (cfg.useACMEHost != null) [
108 "fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
109 "key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
110 ];
111 };
112 };
113
114 # postRun hooks on cert renew can't be used to restart Nginx since renewal
115 # runs as the unprivileged acme user. sslTargets are added to wantedBy + before
116 # which allows the acme-finished-$cert.target to signify the successful updating
117 # of certs end-to-end.
118 systemd.services.pomerium-config-reload = mkIf (cfg.useACMEHost != null) {
119 # TODO(lukegb): figure out how to make config reloading work with credentials.
120
121 wantedBy = [ "acme-finished-${cfg.useACMEHost}.target" "multi-user.target" ];
122 # Before the finished targets, after the renew services.
123 before = [ "acme-finished-${cfg.useACMEHost}.target" ];
124 after = [ "acme-${cfg.useACMEHost}.service" ];
125 # Block reloading if not all certs exist yet.
126 unitConfig.ConditionPathExists = [ "${config.security.acme.certs.${cfg.useACMEHost}.directory}/fullchain.pem" ];
127 serviceConfig = {
128 Type = "oneshot";
129 TimeoutSec = 60;
130 ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active pomerium.service";
131 ExecStart = "/run/current-system/systemd/bin/systemctl --no-block restart pomerium.service";
132 };
133 };
134 });
135}