nixos/snowflake-proxy: init
This commit introduces snowflake-proxy [1], a system to circumvent internet censorship. [1] https://snowflake.torproject.org/
This commit is contained in:
parent
947b2f9f54
commit
38246ed194
|
@ -120,6 +120,13 @@
|
|||
<link xlink:href="options.html#opt-services.heisenbridge.enable">services.heisenbridge</link>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<link xlink:href="https://snowflake.torproject.org/">snowflake-proxy</link>,
|
||||
a system to defeat internet censorship. Available as
|
||||
<link xlink:href="options.html#opt-services.snowflake-proxy.enable">services.snowflake-proxy</link>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<link xlink:href="https://ergo.chat">ergochat</link>, a modern
|
||||
|
|
|
@ -37,6 +37,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
|
||||
- [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](options.html#opt-services.heisenbridge.enable).
|
||||
|
||||
- [snowflake-proxy](https://snowflake.torproject.org/), a system to defeat internet censorship. Available as [services.snowflake-proxy](options.html#opt-services.snowflake-proxy.enable).
|
||||
|
||||
- [ergochat](https://ergo.chat), a modern IRC with IRCv3 features. Available as [services.ergochat](options.html#opt-services.ergochat.enable).
|
||||
|
||||
- [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](options.html#opt-services.powerdns-admin.enable).
|
||||
|
|
|
@ -877,6 +877,7 @@
|
|||
./services/networking/shorewall6.nix
|
||||
./services/networking/shout.nix
|
||||
./services/networking/sniproxy.nix
|
||||
./services/networking/snowflake-proxy.nix
|
||||
./services/networking/smartdns.nix
|
||||
./services/networking/smokeping.nix
|
||||
./services/networking/softether.nix
|
||||
|
|
81
nixos/modules/services/networking/snowflake-proxy.nix
Normal file
81
nixos/modules/services/networking/snowflake-proxy.nix
Normal file
|
@ -0,0 +1,81 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.snowflake-proxy;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.snowflake-proxy = {
|
||||
enable = mkEnableOption "System to defeat internet censorship";
|
||||
|
||||
broker = mkOption {
|
||||
description = "Broker URL (default \"https://snowflake-broker.torproject.net/\")";
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
|
||||
capacity = mkOption {
|
||||
description = "Limits the amount of maximum concurrent clients allowed.";
|
||||
type = with types; nullOr int;
|
||||
default = null;
|
||||
};
|
||||
|
||||
relay = mkOption {
|
||||
description = "websocket relay URL (default \"wss://snowflake.bamsoftware.com/\")";
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
|
||||
stun = mkOption {
|
||||
description = "STUN broker URL (default \"stun:stun.stunprotocol.org:3478\")";
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.snowflake-proxy = {
|
||||
wantedBy = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart =
|
||||
"${pkgs.snowflake}/bin/proxy " + concatStringsSep " " (
|
||||
optional (cfg.broker != null) "-broker ${cfg.broker}"
|
||||
++ optional (cfg.capacity != null) "-capacity ${builtins.toString cfg.capacity}"
|
||||
++ optional (cfg.relay != null) "-relay ${cfg.relay}"
|
||||
++ optional (cfg.stun != null) "-stun ${cfg.stun}"
|
||||
);
|
||||
|
||||
# Security Hardening
|
||||
# Refer to systemd.exec(5) for option descriptions.
|
||||
CapabilityBoundingSet = "";
|
||||
|
||||
# implies RemoveIPC=, PrivateTmp=, NoNewPrivileges=, RestrictSUIDSGID=,
|
||||
# ProtectSystem=strict, ProtectHome=read-only
|
||||
DynamicUser = true;
|
||||
LockPersonality = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = "~@clock @cpu-emulation @debug @mount @obsolete @reboot @swap @privileged @resources";
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
meta.maintainers = with maintainers; [ yayayayaka ];
|
||||
}
|
Loading…
Reference in a new issue