pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 cfg = config.services.cloudflared;
7
8 originRequest = {
9 connectTimeout = mkOption {
10 type = with types; nullOr str;
11 default = null;
12 example = "30s";
13 description = ''
14 Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [tlsTimeout](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout).
15 '';
16 };
17
18 tlsTimeout = mkOption {
19 type = with types; nullOr str;
20 default = null;
21 example = "10s";
22 description = ''
23 Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
24 '';
25 };
26
27 tcpKeepAlive = mkOption {
28 type = with types; nullOr str;
29 default = null;
30 example = "30s";
31 description = ''
32 The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
33 '';
34 };
35
36 noHappyEyeballs = mkOption {
37 type = with types; nullOr bool;
38 default = null;
39 example = false;
40 description = ''
41 Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
42 '';
43 };
44
45 keepAliveConnections = mkOption {
46 type = with types; nullOr int;
47 default = null;
48 example = 100;
49 description = ''
50 Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
51 '';
52 };
53
54 keepAliveTimeout = mkOption {
55 type = with types; nullOr str;
56 default = null;
57 example = "1m30s";
58 description = ''
59 Timeout after which an idle keepalive connection can be discarded.
60 '';
61 };
62
63 httpHostHeader = mkOption {
64 type = with types; nullOr str;
65 default = null;
66 example = "";
67 description = ''
68 Sets the HTTP `Host` header on requests sent to the local service.
69 '';
70 };
71
72 originServerName = mkOption {
73 type = with types; nullOr str;
74 default = null;
75 example = "";
76 description = ''
77 Hostname that `cloudflared` should expect from your origin server certificate.
78 '';
79 };
80
81 caPool = mkOption {
82 type = with types; nullOr (either str path);
83 default = null;
84 example = "";
85 description = ''
86 Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
87 '';
88 };
89
90 noTLSVerify = mkOption {
91 type = with types; nullOr bool;
92 default = null;
93 example = false;
94 description = ''
95 Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
96 '';
97 };
98
99 disableChunkedEncoding = mkOption {
100 type = with types; nullOr bool;
101 default = null;
102 example = false;
103 description = ''
104 Disables chunked transfer encoding. Useful if you are running a WSGI server.
105 '';
106 };
107
108 proxyAddress = mkOption {
109 type = with types; nullOr str;
110 default = null;
111 example = "127.0.0.1";
112 description = ''
113 `cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen address for that proxy.
114 '';
115 };
116
117 proxyPort = mkOption {
118 type = with types; nullOr int;
119 default = null;
120 example = 0;
121 description = ''
122 `cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen port for that proxy. If set to zero, an unused port will randomly be chosen.
123 '';
124 };
125
126 proxyType = mkOption {
127 type = with types; nullOr (enum [ "" "socks" ]);
128 default = null;
129 example = "";
130 description = ''
131 `cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are:
132
133 - `""` for the regular proxy
134 - `"socks"` for a SOCKS5 proxy. Refer to the [https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/](tutorial on connecting through Cloudflare Access using kubectl) for more information.
135 '';
136 };
137 };
138in
139{
140 options.services.cloudflared = {
141 enable = mkEnableOption "Cloudflare Tunnel client daemon (formerly Argo Tunnel)";
142
143 user = mkOption {
144 type = types.str;
145 default = "cloudflared";
146 description = "User account under which Cloudflared runs.";
147 };
148
149 group = mkOption {
150 type = types.str;
151 default = "cloudflared";
152 description = "Group under which cloudflared runs.";
153 };
154
155 package = mkPackageOption pkgs "cloudflared" { };
156
157 tunnels = mkOption {
158 description = ''
159 Cloudflare tunnels.
160 '';
161 type = types.attrsOf (types.submodule ({ name, ... }: {
162 options = {
163 inherit originRequest;
164
165 credentialsFile = mkOption {
166 type = types.str;
167 description = ''
168 Credential file.
169
170 See [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-useful-terms/#credentials-file](Credentials file).
171 '';
172 };
173
174 warp-routing = {
175 enabled = mkOption {
176 type = with types; nullOr bool;
177 default = null;
178 description = ''
179 Enable warp routing.
180
181 See [https://developers.cloudflare.com/cloudflare-one/tutorials/warp-to-tunnel/](Connect from WARP to a private network on Cloudflare using Cloudflare Tunnel).
182 '';
183 };
184 };
185
186 default = mkOption {
187 type = types.str;
188 description = ''
189 Catch-all service if no ingress matches.
190
191 See `service`.
192 '';
193 example = "http_status:404";
194 };
195
196 ingress = mkOption {
197 type = with types; attrsOf (either str (submodule ({ hostname, ... }: {
198 options = {
199 inherit originRequest;
200
201 service = mkOption {
202 type = with types; nullOr str;
203 default = null;
204 description = ''
205 Service to pass the traffic.
206
207 See [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#supported-protocols](Supported protocols).
208 '';
209 example = "http://localhost:80, tcp://localhost:8000, unix:/home/production/echo.sock, hello_world or http_status:404";
210 };
211
212 path = mkOption {
213 type = with types; nullOr str;
214 default = null;
215 description = ''
216 Path filter.
217
218 If not specified, all paths will be matched.
219 '';
220 example = "/*.(jpg|png|css|js)";
221 };
222
223 };
224 })));
225 default = { };
226 description = ''
227 Ingress rules.
228
229 See [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/](Ingress rules).
230 '';
231 example = {
232 "*.domain.com" = "http://localhost:80";
233 "*.anotherone.com" = "http://localhost:80";
234 };
235 };
236 };
237 }));
238
239 default = { };
240 example = {
241 "00000000-0000-0000-0000-000000000000" = {
242 credentialsFile = "/tmp/test";
243 ingress = {
244 "*.domain1.com" = {
245 service = "http://localhost:80";
246 };
247 };
248 default = "http_status:404";
249 };
250 };
251 };
252 };
253
254 config = mkIf cfg.enable {
255 systemd.targets =
256 mapAttrs'
257 (name: tunnel:
258 nameValuePair "cloudflared-tunnel-${name}" {
259 description = "Cloudflare tunnel '${name}' target";
260 requires = [ "cloudflared-tunnel-${name}.service" ];
261 after = [ "cloudflared-tunnel-${name}.service" ];
262 unitConfig.StopWhenUnneeded = true;
263 }
264 )
265 config.services.cloudflared.tunnels;
266
267 systemd.services =
268 mapAttrs'
269 (name: tunnel:
270 let
271 filterConfig = lib.attrsets.filterAttrsRecursive (_: v: ! builtins.elem v [ null [ ] { } ]);
272
273 filterIngressSet = filterAttrs (_: v: builtins.typeOf v == "set");
274 filterIngressStr = filterAttrs (_: v: builtins.typeOf v == "string");
275
276 ingressesSet = filterIngressSet tunnel.ingress;
277 ingressesStr = filterIngressStr tunnel.ingress;
278
279 fullConfig = filterConfig {
280 tunnel = name;
281 "credentials-file" = tunnel.credentialsFile;
282 warp-routing = filterConfig tunnel.warp-routing;
283 originRequest = filterConfig tunnel.originRequest;
284 ingress =
285 (map
286 (key: {
287 hostname = key;
288 } // getAttr key (filterConfig (filterConfig ingressesSet)))
289 (attrNames ingressesSet))
290 ++
291 (map
292 (key: {
293 hostname = key;
294 service = getAttr key ingressesStr;
295 })
296 (attrNames ingressesStr))
297 ++ [{ service = tunnel.default; }];
298 };
299
300 mkConfigFile = pkgs.writeText "cloudflared.yml" (builtins.toJSON fullConfig);
301 in
302 nameValuePair "cloudflared-tunnel-${name}" ({
303 after = [ "network.target" "network-online.target" ];
304 wants = [ "network.target" "network-online.target" ];
305 wantedBy = [ "multi-user.target" ];
306 serviceConfig = {
307 User = cfg.user;
308 Group = cfg.group;
309 ExecStart = "${cfg.package}/bin/cloudflared tunnel --config=${mkConfigFile} --no-autoupdate run";
310 Restart = "on-failure";
311 };
312 })
313 )
314 config.services.cloudflared.tunnels;
315
316 users.users = mkIf (cfg.user == "cloudflared") {
317 cloudflared = {
318 group = cfg.group;
319 isSystemUser = true;
320 };
321 };
322
323 users.groups = mkIf (cfg.group == "cloudflared") {
324 cloudflared = { };
325 };
326 };
327
328 meta.maintainers = with maintainers; [ bbigras anpin ];
329}