commit 66e54f25a160ed1cd9d0a008c2c61f9c30a84eb1 · pyrox.dev/nixpkgs

+65 -48
nixos/modules/security/dhparams.nix
···

       19
       19
        
                   Note: The name of the DH params is taken as being the name of the

     

       20
       20
        
                   service it serves: the params will be generated before the said

     

       21
       21
        
                   service is started.

     

       22
       22
       +
       

     

       23
       23
       +
                   Warning: If you are removing all dhparams from this list, you have

     

       24
       24
       +
                   to leave security.dhparams.enable for at least one activation in

     

       25
       25
       +
                   order to have them be cleaned up. This also means if you rollback to

     

       26
       26
       +
                   a version without any dhparams the existing ones won't be cleaned

     

       27
       27
       +
                   up.

     

       22
       28
        
                 '';

     

       23
       29
        
               type = with types; attrsOf int;

     

       24
       30
        
               default = {};

     
···

       33
       39
        
                 '';

     

       34
       40
        
               type = types.str;

     

       35
       41
        
               default = "/var/lib/dhparams";

     

       42
       42
       +
             };

     

       43
       43
       +
       

     

       44
       44
       +
             enable = mkOption {

     

       45
       45
       +
               description =

     

       46
       46
       +
                 ''

     

       47
       47
       +
                   Whether to generate new DH params and clean up old DH params.

     

       48
       48
       +
                 '';

     

       49
       49
       +
               default = false;

     

       50
       50
       +
               type = types.bool;

     

       36
       51
        
             };

     

       37
       52
        
           };

     

       38
       53
        
         };

     

       39
       54
        
       

     

       40
       40
       -
         config.systemd.services = {

     

       41
       41
       -
           dhparams-init = {

     

       42
       42
       -
             description = "Cleanup old Diffie-Hellman parameters";

     

       43
       43
       -
             wantedBy = [ "multi-user.target" ]; # Clean up even when no DH params is set

     

       44
       44
       -
             serviceConfig.Type = "oneshot";

     

       45
       45
       -
             script =

     

       46
       46
       -
               # Create directory

     

       47
       47
       -
               ''

     

       48
       48
       -
                 if [ ! -d ${cfg.path} ]; then

     

       55
       55
       +
         config = mkIf cfg.enable {

     

       56
       56
       +
           systemd.services = {

     

       57
       57
       +
             dhparams-init = {

     

       58
       58
       +
               description = "Cleanup old Diffie-Hellman parameters";

     

       59
       59
       +
               wantedBy = [ "multi-user.target" ]; # Clean up even when no DH params is set

     

       60
       60
       +
               serviceConfig.Type = "oneshot";

     

       61
       61
       +
               script =

     

       62
       62
       +
                 # Create directory

     

       63
       63
       +
                 ''

     

       64
       64
       +
                   if [ ! -d ${cfg.path} ]; then

     

       65
       65
       +
                     mkdir -p ${cfg.path}

     

       66
       66
       +
                   fi

     

       67
       67
       +
                 '' +

     

       68
       68
       +
                 # Remove old dhparams

     

       69
       69
       +
                 ''

     

       70
       70
       +
                   for file in ${cfg.path}/*; do

     

       71
       71
       +
                     if [ ! -f "$file" ]; then

     

       72
       72
       +
                       continue

     

       73
       73
       +
                     fi

     

       74
       74
       +
                 '' + concatStrings (mapAttrsToList (name: value:

     

       75
       75
       +
                 ''

     

       76
       76
       +
                     if [ "$file" == "${cfg.path}/${name}.pem" ] && \

     

       77
       77
       +
                         ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text | head -n 1 | grep "(${toString value} bit)" > /dev/null; then

     

       78
       78
       +
                       continue

     

       79
       79
       +
                     fi

     

       80
       80
       +
                 ''

     

       81
       81
       +
                 ) cfg.params) +

     

       82
       82
       +
                 ''

     

       83
       83
       +
                     rm $file

     

       84
       84
       +
                   done

     

       85
       85
       +
       

     

       86
       86
       +
                   # TODO: Ideally this would be removing the *former* cfg.path, though this

     

       87
       87
       +
                   # does not seem really important as changes to it are quite unlikely

     

       88
       88
       +
                   rmdir --ignore-fail-on-non-empty ${cfg.path}

     

       89
       89
       +
                 '';

     

       90
       90
       +
             };

     

       91
       91
       +
           } //

     

       92
       92
       +
             mapAttrs' (name: value: nameValuePair "dhparams-gen-${name}" {

     

       93
       93
       +
               description = "Generate Diffie-Hellman parameters for ${name} if they don't exist yet";

     

       94
       94
       +
               after = [ "dhparams-init.service" ];

     

       95
       95
       +
               before = [ "${name}.service" ];

     

       96
       96
       +
               wantedBy = [ "multi-user.target" ];

     

       97
       97
       +
               serviceConfig.Type = "oneshot";

     

       98
       98
       +
               script =

     

       99
       99
       +
                 ''

     

       49
       100
        
                   mkdir -p ${cfg.path}

     

       50
       50
       -
                 fi

     

       51
       51
       -
               '' +

     

       52
       52
       -
               # Remove old dhparams

     

       53
       53
       -
               ''

     

       54
       54
       -
                 for file in ${cfg.path}/*; do

     

       55
       55
       -
                   if [ ! -f "$file" ]; then

     

       56
       56
       -
                     continue

     

       57
       57
       -
                   fi

     

       58
       58
       -
               '' + concatStrings (mapAttrsToList (name: value:

     

       59
       59
       -
               ''

     

       60
       60
       -
                   if [ "$file" == "${cfg.path}/${name}.pem" ] && \

     

       61
       61
       -
                       ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text | head -n 1 | grep "(${toString value} bit)" > /dev/null; then

     

       62
       62
       -
                     continue

     

       101
       101
       +
                   if [ ! -f ${cfg.path}/${name}.pem ]; then

     

       102
       102
       +
                     ${pkgs.openssl}/bin/openssl dhparam -out ${cfg.path}/${name}.pem ${toString value}

     

       63
       103
        
                   fi

     

       64
       64
       -
               ''

     

       65
       65
       -
               ) cfg.params) +

     

       66
       66
       -
               ''

     

       67
       67
       -
                   rm $file

     

       68
       68
       -
                 done

     

       69
       69
       -
       

     

       70
       70
       -
                 # TODO: Ideally this would be removing the *former* cfg.path, though this

     

       71
       71
       -
                 # does not seem really important

     

       72
       72
       -
                 rmdir -p --ignore-fail-on-non-empty ${cfg.path}

     

       73
       73
       -
               '';

     

       74
       74
       -
           };

     

       75
       75
       -
         } //

     

       76
       76
       -
           mapAttrs' (name: value: nameValuePair "dhparams-gen-${name}" {

     

       77
       77
       -
             description = "Generate Diffie-Hellman parameters for ${name} if they don't exist yet";

     

       78
       78
       -
             after = [ "dhparams-init.service" ];

     

       79
       79
       -
             before = [ "${name}.service" ];

     

       80
       80
       -
             wantedBy = [ "multi-user.target" ];

     

       81
       81
       -
             serviceConfig.Type = "oneshot";

     

       82
       82
       -
             script =

     

       83
       83
       -
               ''

     

       84
       84
       -
                 mkdir -p ${cfg.path}

     

       85
       85
       -
                 if [ ! -f ${cfg.path}/${name}.pem ]; then

     

       86
       86
       -
                   ${pkgs.openssl}/bin/openssl dhparam -out ${cfg.path}/${name}.pem ${toString value}

     

       87
       87
       -
                 fi

     

       88
       88
       -
               '';

     

       89
       89
       -
           }) cfg.params;

     

       104
       104
       +
                 '';

     

       105
       105
       +
             }) cfg.params;

     

       106
       106
       +
         };

     

       90
       107
        
       }