pyrox.dev
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8with lib;
9
10let
11 format = pkgs.formats.yaml { };
12in
13{
14 options.services.pomerium = {
15 enable = mkEnableOption "the Pomerium authenticating reverse proxy";
16
17 configFile = mkOption {
18 type = with types; nullOr path;
19 default = null;
20 description = "Path to Pomerium config YAML. If set, overrides services.pomerium.settings.";
21 };
22
23 useACMEHost = mkOption {
24 type = with types; nullOr str;
25 default = null;
26 description = ''
27 If set, use a NixOS-generated ACME certificate with the specified name.
28
29 Note that this will require you to use a non-HTTP-based challenge, or
30 disable Pomerium's in-built HTTP redirect server by setting
31 http_redirect_addr to null and use a different HTTP server for serving
32 the challenge response.
33
34 If you're using an HTTP-based challenge, you should use the
35 Pomerium-native autocert option instead.
36 '';
37 };
38
39 settings = mkOption {
40 description = ''
41 The contents of Pomerium's config.yaml, in Nix expressions.
42
43 Specifying configFile will override this in its entirety.
44
45 See [the Pomerium
46 configuration reference](https://pomerium.io/reference/) for more information about what to put
47 here.
48 '';
49 default = { };
50 type = format.type;
51 };
52
53 secretsFile = mkOption {
54 type = with types; nullOr path;
55 default = null;
56 description = ''
57 Path to file containing secrets for Pomerium, in systemd
58 EnvironmentFile format. See the {manpage}`systemd.exec(5)` man page.
59 '';
60 };
61 };
62
63 config =
64 let
65 cfg = config.services.pomerium;
66 cfgFile =
67 if cfg.configFile != null then cfg.configFile else (format.generate "pomerium.yaml" cfg.settings);
68 in
69 mkIf cfg.enable ({
70 systemd.services.pomerium = {
71 description = "Pomerium authenticating reverse proxy";
72 wants = [
73 "network.target"
74 ] ++ (optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target");
75 after = [
76 "network.target"
77 ] ++ (optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target");
78 wantedBy = [ "multi-user.target" ];
79 environment = optionalAttrs (cfg.useACMEHost != null) {
80 CERTIFICATE_FILE = "fullchain.pem";
81 CERTIFICATE_KEY_FILE = "key.pem";
82 };
83 startLimitIntervalSec = 60;
84 script = ''
85 if [[ -v CREDENTIALS_DIRECTORY ]]; then
86 cd "$CREDENTIALS_DIRECTORY"
87 fi
88 exec "${pkgs.pomerium}/bin/pomerium" -config "${cfgFile}"
89 '';
90
91 serviceConfig = {
92 DynamicUser = true;
93 StateDirectory = [ "pomerium" ];
94
95 PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
96 MemoryDenyWriteExecute = false; # breaks LuaJIT
97
98 NoNewPrivileges = true;
99 PrivateTmp = true;
100 PrivateDevices = true;
101 DevicePolicy = "closed";
102 ProtectSystem = "strict";
103 ProtectHome = true;
104 ProtectControlGroups = true;
105 ProtectKernelModules = true;
106 ProtectKernelTunables = true;
107 ProtectKernelLogs = true;
108 RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
109 RestrictNamespaces = true;
110 RestrictRealtime = true;
111 RestrictSUIDSGID = true;
112 LockPersonality = true;
113 SystemCallArchitectures = "native";
114
115 EnvironmentFile = cfg.secretsFile;
116 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
117 CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
118
119 LoadCredential = optionals (cfg.useACMEHost != null) [
120 "fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
121 "key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
122 ];
123 };
124 };
125
126 # postRun hooks on cert renew can't be used to restart Nginx since renewal
127 # runs as the unprivileged acme user. sslTargets are added to wantedBy + before
128 # which allows the acme-finished-$cert.target to signify the successful updating
129 # of certs end-to-end.
130 systemd.services.pomerium-config-reload = mkIf (cfg.useACMEHost != null) {
131 # TODO(lukegb): figure out how to make config reloading work with credentials.
132
133 wantedBy = [
134 "acme-finished-${cfg.useACMEHost}.target"
135 "multi-user.target"
136 ];
137 # Before the finished targets, after the renew services.
138 before = [ "acme-finished-${cfg.useACMEHost}.target" ];
139 after = [ "acme-${cfg.useACMEHost}.service" ];
140 # Block reloading if not all certs exist yet.
141 unitConfig.ConditionPathExists = [
142 "${config.security.acme.certs.${cfg.useACMEHost}.directory}/fullchain.pem"
143 ];
144 serviceConfig = {
145 Type = "oneshot";
146 TimeoutSec = 60;
147 ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active pomerium.service";
148 ExecStart = "/run/current-system/systemd/bin/systemctl --no-block restart pomerium.service";
149 };
150 };
151 });
152}