host(ryo): forget about dns-01, use http-01 instead

Changed files
+29 -13
systems
ryo
-5
systems/ryo/certificates/default.nix
···
-
{...}: {
-
imports = [
-
./ryo.nix
-
];
-
}
-5
systems/ryo/certificates/ryo.nix
···
-
{...}: {
-
security.acme.certs."ryo.soopy.moe" = {
-
group = "nginx";
-
};
-
}
-1
systems/ryo/configuration.nix
···
# DO NOT copy anything done on this host, it's insecure by design.
{...}: {
imports = [
-
./certificates
./services
];
+29 -2
systems/ryo/services/novnc.nix
···
-
{_utils, pkgs, lib, ...}: {
+
{
+
_utils,
+
pkgs,
+
lib,
+
...
+
}: {
services.nginx.virtualHosts."ryo.soopy.moe" = _utils.mkSimpleProxy {
port = 6080;
websockets = true;
extraConfig = {
locations."= /".return = "303 /vnc_lite.html";
-
useACMEHost = "ryo.soopy.moe";
+
enableACME = true; # don't bother with DNS-01
+
useACMEHost = null;
};
};
systemd.services."novnc" = {
+
enable = true;
+
wantedBy = ["multi-user.target"];
+
path = with pkgs; [procps];
serviceConfig = {
DynamicUser = true;
ExecStart = "${lib.getExe pkgs.novnc} --file-only";
+
+
# hardening
+
PrivateUsers = true;
+
LockPersonality = true;
+
ProtectHostname = true;
+
ProtectKernelTunables = true;
+
ProtectDevices = true;
+
ProtectClock = true;
+
SystemCallArchitectures = "native";
+
CapabilityBoundingSet = null;
+
RestrictAddressFamilies = [
+
"AF_INET"
+
"AF_INET6"
+
];
+
SystemCallFilter = [
+
"@system-service"
+
"~@privileged"
+
];
};
};
}