pyrox.dev
1{
2 config,
3 pkgs,
4 lib,
5 ...
6}:
7
8with lib;
9
10let
11 cfg = config.services.teleport;
12 settingsYaml = pkgs.formats.yaml { };
13in
14{
15 options = {
16 services.teleport = with lib.types; {
17 enable = mkEnableOption "the Teleport service";
18
19 package = mkPackageOption pkgs "teleport" {
20 example = "teleport_11";
21 };
22
23 settings = mkOption {
24 type = settingsYaml.type;
25 default = { };
26 example = literalExpression ''
27 {
28 teleport = {
29 nodename = "client";
30 advertise_ip = "192.168.1.2";
31 auth_token = "60bdc117-8ff4-478d-95e4-9914597847eb";
32 auth_servers = [ "192.168.1.1:3025" ];
33 log.severity = "DEBUG";
34 };
35 ssh_service = {
36 enabled = true;
37 labels = {
38 role = "client";
39 };
40 };
41 proxy_service.enabled = false;
42 auth_service.enabled = false;
43 }
44 '';
45 description = ''
46 Contents of the `teleport.yaml` config file.
47 The `--config` arguments will only be passed if this set is not empty.
48
49 See <https://goteleport.com/docs/setup/reference/config/>.
50 '';
51 };
52
53 insecure.enable = mkEnableOption ''
54 starting teleport in insecure mode.
55
56 This is dangerous!
57 Sensitive information will be logged to console and certificates will not be verified.
58 Proceed with caution!
59
60 Teleport starts with disabled certificate validation on Proxy Service, validation still occurs on Auth Service
61 '';
62
63 diag = {
64 enable = mkEnableOption ''
65 endpoints for monitoring purposes.
66
67 See <https://goteleport.com/docs/setup/admin/troubleshooting/#troubleshooting/>
68 '';
69
70 addr = mkOption {
71 type = str;
72 default = "127.0.0.1";
73 description = "Metrics and diagnostics address.";
74 };
75
76 port = mkOption {
77 type = port;
78 default = 3000;
79 description = "Metrics and diagnostics port.";
80 };
81 };
82 };
83 };
84
85 config = mkIf config.services.teleport.enable {
86 environment.systemPackages = [ cfg.package ];
87
88 systemd.services.teleport = {
89 wantedBy = [ "multi-user.target" ];
90 after = [ "network.target" ];
91 path = with pkgs; [
92 getent
93 shadow
94 sudo
95 ];
96 serviceConfig = {
97 ExecStart = ''
98 ${cfg.package}/bin/teleport start \
99 ${optionalString cfg.insecure.enable "--insecure"} \
100 ${optionalString cfg.diag.enable "--diag-addr=${cfg.diag.addr}:${toString cfg.diag.port}"} \
101 ${optionalString (
102 cfg.settings != { }
103 ) "--config=${settingsYaml.generate "teleport.yaml" cfg.settings}"}
104 '';
105 ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
106 LimitNOFILE = 65536;
107 Restart = "always";
108 RestartSec = "5s";
109 RuntimeDirectory = "teleport";
110 Type = "simple";
111 };
112 };
113 };
114}