···

       
721
       
 
       
     automatically based on <option>system.stateVersion</option>, the latest

     

       
722
       
 
       
     version is always used because old versions are not officially supported.

     

       
723
       
 
       
    </para>

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
724
       
 
       
   </listitem>

     

       
725
       
 
       
  </itemizedlist>

     

       
726
       
 
       
 </section>

     

···

       
721
       
 
       
     automatically based on <option>system.stateVersion</option>, the latest

     

       
722
       
 
       
     version is always used because old versions are not officially supported.

     

       
723
       
 
       
    </para>

     

       
724
       
+
       
    <para>

     

       
725
       
+
       
     Furthermore, Radicale's systemd unit was hardened which might break some

     

       
726
       
+
       
     deployments.  In particular, a non-default

     

       
727
       
+
       
     <literal>filesystem_folder</literal> has to be added to

     

       
728
       
+
       
     <option>systemd.services.radicale.serviceConfig.ReadWritePaths</option> if

     

       
729
       
+
       
     the deprecated <option>services.radicale.config</option> is used.

     

       
730
       
+
       
    </para>

     

       
731
       
 
       
   </listitem>

     

       
732
       
 
       
  </itemizedlist>

     

       
733
       
 
       
 </section>

     

···

       
21
       
 
       


     

       
22
       
 
       
  rightsFile = format.generate "radicale.rights" cfg.rights;

     

       
23
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
24
       
 
       
in {

     

       
25
       
 
       
  options.services.radicale = {

     

       
26
       
 
       
    enable = mkEnableOption "Radicale CalDAV and CardDAV server";

     
···

       
138
       
 
       


     

       
139
       
 
       
    environment.systemPackages = [ pkg ];

     

       
140
       
 
       


     

       
141
       
-
       
    users.users.radicale =

     

       
142
       
-
       
      { uid = config.ids.uids.radicale;

     

       
143
       
-
       
        description = "radicale user";

     

       
144
       
-
       
        home = "/var/lib/radicale";

     

       
145
       
-
       
        createHome = true;

     

       
146
       
-
       
      };

     

       
147
       
 
       


     

       
148
       
-
       
    users.groups.radicale =

     

       
149
       
-
       
      { gid = config.ids.gids.radicale; };

     

       
150
       
 
       


     

       
151
       
 
       
    systemd.services.radicale = {

     

       
152
       
 
       
      description = "A Simple Calendar and Contact Server";

     
···

       
161
       
 
       
        ));

     

       
162
       
 
       
        User = "radicale";

     

       
163
       
 
       
        Group = "radicale";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
164
       
 
       
      };

     

       
165
       
 
       
    };

     

       
166
       
 
       
  };

     

···

       
21
       
 
       


     

       
22
       
 
       
  rightsFile = format.generate "radicale.rights" cfg.rights;

     

       
23
       
 
       


     

       
24
       
+
       
  bindLocalhost = cfg.settings != { } && !hasAttrByPath [ "server" "hosts" ] cfg.settings;

     

       
25
       
+
       


     

       
26
       
 
       
in {

     

       
27
       
 
       
  options.services.radicale = {

     

       
28
       
 
       
    enable = mkEnableOption "Radicale CalDAV and CardDAV server";

     
···

       
140
       
 
       


     

       
141
       
 
       
    environment.systemPackages = [ pkg ];

     

       
142
       
 
       


     

       
143
       
+
       
    users.users.radicale.uid = config.ids.uids.radicale;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
144
       
 
       


     

       
145
       
+
       
    users.groups.radicale.gid = config.ids.gids.radicale;

     

       
0
       
 
       

     

       
146
       
 
       


     

       
147
       
 
       
    systemd.services.radicale = {

     

       
148
       
 
       
      description = "A Simple Calendar and Contact Server";

     
···

       
157
       
 
       
        ));

     

       
158
       
 
       
        User = "radicale";

     

       
159
       
 
       
        Group = "radicale";

     

       
160
       
+
       
        StateDirectory = "radicale/collections";

     

       
161
       
+
       
        StateDirectoryMode = "0750";

     

       
162
       
+
       
        # Hardening

     

       
163
       
+
       
        CapabilityBoundingSet = [ "" ];

     

       
164
       
+
       
        DeviceAllow = [ "/dev/stdin" ];

     

       
165
       
+
       
        DevicePolicy = "strict";

     

       
166
       
+
       
        IPAddressAllow = mkIf bindLocalhost "localhost";

     

       
167
       
+
       
        IPAddressDeny = mkIf bindLocalhost "any";

     

       
168
       
+
       
        LockPersonality = true;

     

       
169
       
+
       
        MemoryDenyWriteExecute = true;

     

       
170
       
+
       
        NoNewPrivileges = true;

     

       
171
       
+
       
        PrivateDevices = true;

     

       
172
       
+
       
        PrivateTmp = true;

     

       
173
       
+
       
        PrivateUsers = true;

     

       
174
       
+
       
        ProcSubset = "pid";

     

       
175
       
+
       
        ProtectClock = true;

     

       
176
       
+
       
        ProtectControlGroups = true;

     

       
177
       
+
       
        ProtectHome = true;

     

       
178
       
+
       
        ProtectHostname = true;

     

       
179
       
+
       
        ProtectKernelLogs = true;

     

       
180
       
+
       
        ProtectKernelModules = true;

     

       
181
       
+
       
        ProtectKernelTunables = true;

     

       
182
       
+
       
        ProtectProc = "invisible";

     

       
183
       
+
       
        ProtectSystem = "strict";

     

       
184
       
+
       
        ReadWritePaths = lib.optional

     

       
185
       
+
       
          (hasAttrByPath [ "storage" "filesystem_folder" ] cfg.settings)

     

       
186
       
+
       
          cfg.settings.storage.filesystem_folder;

     

       
187
       
+
       
        RemoveIPC = true;

     

       
188
       
+
       
        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

     

       
189
       
+
       
        RestrictNamespaces = true;

     

       
190
       
+
       
        RestrictRealtime = true;

     

       
191
       
+
       
        RestrictSUIDSGID = true;

     

       
192
       
+
       
        SystemCallArchitectures = "native";

     

       
193
       
+
       
        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];

     

       
194
       
+
       
        UMask = "0027";

     

       
195
       
 
       
      };

     

       
196
       
 
       
    };

     

       
197
       
 
       
  };

     

···

       
86
       
 
       


     

       
87
       
 
       
    with subtest("Test web interface"):

     

       
88
       
 
       
        machine.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
89
       
 
       
  '';

     

       
90
       
 
       
})

     

···

       
86
       
 
       


     

       
87
       
 
       
    with subtest("Test web interface"):

     

       
88
       
 
       
        machine.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")

     

       
89
       
+
       


     

       
90
       
+
       
    with subtest("Test security"):

     

       
91
       
+
       
        output = machine.succeed("systemd-analyze security radicale.service")

     

       
92
       
+
       
        machine.log(output)

     

       
93
       
+
       
        assert output[-9:-1] == "SAFE :-}"

     

       
94
       
 
       
  '';

     

       
95
       
 
       
})