pyrox.dev
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8with lib;
9
10let
11 format = pkgs.formats.yaml { };
12in
13{
14 options.services.pomerium = {
15 enable = mkEnableOption "the Pomerium authenticating reverse proxy";
16
17 configFile = mkOption {
18 type = with types; nullOr path;
19 default = null;
20 description = "Path to Pomerium config YAML. If set, overrides services.pomerium.settings.";
21 };
22
23 useACMEHost = mkOption {
24 type = with types; nullOr str;
25 default = null;
26 description = ''
27 If set, use a NixOS-generated ACME certificate with the specified name.
28
29 Note that this will require you to use a non-HTTP-based challenge, or
30 disable Pomerium's in-built HTTP redirect server by setting
31 http_redirect_addr to null and use a different HTTP server for serving
32 the challenge response.
33
34 If you're using an HTTP-based challenge, you should use the
35 Pomerium-native autocert option instead.
36 '';
37 };
38
39 settings = mkOption {
40 description = ''
41 The contents of Pomerium's config.yaml, in Nix expressions.
42
43 Specifying configFile will override this in its entirety.
44
45 See [the Pomerium
46 configuration reference](https://pomerium.io/reference/) for more information about what to put
47 here.
48 '';
49 default = { };
50 type = format.type;
51 };
52
53 secretsFile = mkOption {
54 type = with types; nullOr path;
55 default = null;
56 description = ''
57 Path to file containing secrets for Pomerium, in systemd
58 EnvironmentFile format. See the {manpage}`systemd.exec(5)` man page.
59 '';
60 };
61 };
62
63 config =
64 let
65 cfg = config.services.pomerium;
66 cfgFile =
67 if cfg.configFile != null then cfg.configFile else (format.generate "pomerium.yaml" cfg.settings);
68 in
69 mkIf cfg.enable ({
70 systemd.services.pomerium = {
71 description = "Pomerium authenticating reverse proxy";
72 wants = [
73 "network.target"
74 ]
75 ++ (optional (cfg.useACMEHost != null) "acme-${cfg.useACMEHost}.service");
76 after = [
77 "network.target"
78 ]
79 ++ (optional (cfg.useACMEHost != null) "acme-${cfg.useACMEHost}.service");
80 wantedBy = [ "multi-user.target" ];
81 environment = optionalAttrs (cfg.useACMEHost != null) {
82 CERTIFICATE_FILE = "fullchain.pem";
83 CERTIFICATE_KEY_FILE = "key.pem";
84 };
85 startLimitIntervalSec = 60;
86 script = ''
87 if [[ -v CREDENTIALS_DIRECTORY ]]; then
88 cd "$CREDENTIALS_DIRECTORY"
89 fi
90 exec "${pkgs.pomerium}/bin/pomerium" -config "${cfgFile}"
91 '';
92
93 serviceConfig = {
94 DynamicUser = true;
95 StateDirectory = [ "pomerium" ];
96
97 PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
98 MemoryDenyWriteExecute = false; # breaks LuaJIT
99
100 NoNewPrivileges = true;
101 PrivateTmp = true;
102 PrivateDevices = true;
103 DevicePolicy = "closed";
104 ProtectSystem = "strict";
105 ProtectHome = true;
106 ProtectControlGroups = true;
107 ProtectKernelModules = true;
108 ProtectKernelTunables = true;
109 ProtectKernelLogs = true;
110 RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
111 RestrictNamespaces = true;
112 RestrictRealtime = true;
113 RestrictSUIDSGID = true;
114 LockPersonality = true;
115 SystemCallArchitectures = "native";
116
117 EnvironmentFile = cfg.secretsFile;
118 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
119 CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
120
121 LoadCredential = optionals (cfg.useACMEHost != null) [
122 "fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
123 "key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
124 ];
125 };
126 };
127
128 # postRun hooks on cert renew can't be used to restart Nginx since renewal
129 # runs as the unprivileged acme user. sslTargets are added to wantedBy + before
130 # which allows the acme-order-renew-$cert.target to signify the successful updating
131 # of certs end-to-end.
132 systemd.services.pomerium-config-reload = mkIf (cfg.useACMEHost != null) {
133 # TODO(lukegb): figure out how to make config reloading work with credentials.
134
135 wantedBy = [
136 "acme-order-renew-${cfg.useACMEHost}.service"
137 "multi-user.target"
138 ];
139 after = [ "acme-order-renew-${cfg.useACMEHost}.service" ];
140 # Block reloading if not all certs exist yet.
141 unitConfig.ConditionPathExists = [
142 "${config.security.acme.certs.${cfg.useACMEHost}.directory}/fullchain.pem"
143 ];
144 serviceConfig = {
145 Type = "oneshot";
146 TimeoutSec = 60;
147 ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active pomerium.service";
148 ExecStart = "/run/current-system/systemd/bin/systemctl --no-block restart pomerium.service";
149 };
150 };
151 });
152}