Merge pull request #166894 from CameronNemo/nixos-mod-envoy
nixos/envoy: init
This commit is contained in:
commit
3838b7e07e
|
@ -1538,6 +1538,13 @@
|
||||||
configuration.
|
configuration.
|
||||||
</para>
|
</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
A new module was added for the Envoy reverse proxy, providing
|
||||||
|
the options <literal>services.envoy.enable</literal> and
|
||||||
|
<literal>services.envoy.settings</literal>.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>
|
<para>
|
||||||
The option <literal>services.duplicati.dataDir</literal> has
|
The option <literal>services.duplicati.dataDir</literal> has
|
||||||
|
|
|
@ -547,6 +547,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
||||||
|
|
||||||
- The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
|
- The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
|
||||||
|
|
||||||
|
- A new module was added for the Envoy reverse proxy, providing the options `services.envoy.enable` and `services.envoy.settings`.
|
||||||
|
|
||||||
- The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.
|
- The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.
|
||||||
|
|
||||||
- The options `boot.extraModprobeConfig` and `boot.blacklistedKernelModules` now also take effect in the initrd by copying the file `/etc/modprobe.d/nixos.conf` into the initrd.
|
- The options `boot.extraModprobeConfig` and `boot.blacklistedKernelModules` now also take effect in the initrd by copying the file `/etc/modprobe.d/nixos.conf` into the initrd.
|
||||||
|
|
|
@ -753,6 +753,7 @@
|
||||||
./services/networking/ncdns.nix
|
./services/networking/ncdns.nix
|
||||||
./services/networking/nomad.nix
|
./services/networking/nomad.nix
|
||||||
./services/networking/ejabberd.nix
|
./services/networking/ejabberd.nix
|
||||||
|
./services/networking/envoy.nix
|
||||||
./services/networking/epmd.nix
|
./services/networking/epmd.nix
|
||||||
./services/networking/ergo.nix
|
./services/networking/ergo.nix
|
||||||
./services/networking/ergochat.nix
|
./services/networking/ergochat.nix
|
||||||
|
|
84
nixos/modules/services/networking/envoy.nix
Normal file
84
nixos/modules/services/networking/envoy.nix
Normal file
|
@ -0,0 +1,84 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.envoy;
|
||||||
|
format = pkgs.formats.json { };
|
||||||
|
conf = format.generate "envoy.json" cfg.settings;
|
||||||
|
validateConfig = file:
|
||||||
|
pkgs.runCommand "validate-envoy-conf" { } ''
|
||||||
|
${pkgs.envoy}/bin/envoy --log-level error --mode validate -c "${file}"
|
||||||
|
cp "${file}" "$out"
|
||||||
|
'';
|
||||||
|
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
options.services.envoy = {
|
||||||
|
enable = mkEnableOption "Envoy reverse proxy";
|
||||||
|
|
||||||
|
settings = mkOption {
|
||||||
|
type = format.type;
|
||||||
|
default = { };
|
||||||
|
example = literalExpression ''
|
||||||
|
{
|
||||||
|
admin = {
|
||||||
|
access_log_path = "/dev/null";
|
||||||
|
address = {
|
||||||
|
socket_address = {
|
||||||
|
protocol = "TCP";
|
||||||
|
address = "127.0.0.1";
|
||||||
|
port_value = 9901;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
static_resources = {
|
||||||
|
listeners = [];
|
||||||
|
clusters = [];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
Specify the configuration for Envoy in Nix.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
environment.systemPackages = [ pkgs.envoy ];
|
||||||
|
systemd.services.envoy = {
|
||||||
|
description = "Envoy reverse proxy";
|
||||||
|
after = [ "network-online.target" ];
|
||||||
|
requires = [ "network-online.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = "${pkgs.envoy}/bin/envoy -c ${validateConfig conf}";
|
||||||
|
DynamicUser = true;
|
||||||
|
Restart = "no";
|
||||||
|
CacheDirectory = "envoy";
|
||||||
|
LogsDirectory = "envoy";
|
||||||
|
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
|
||||||
|
CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
|
||||||
|
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK AF_XDP";
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
LockPersonality = true;
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
|
||||||
|
PrivateDevices = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectProc = "ptraceable";
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
UMask = "0066";
|
||||||
|
SystemCallFilter = "~@clock @module @mount @reboot @swap @obsolete @cpu-emulation";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -142,6 +142,7 @@ in
|
||||||
engelsystem = handleTest ./engelsystem.nix {};
|
engelsystem = handleTest ./engelsystem.nix {};
|
||||||
enlightenment = handleTest ./enlightenment.nix {};
|
enlightenment = handleTest ./enlightenment.nix {};
|
||||||
env = handleTest ./env.nix {};
|
env = handleTest ./env.nix {};
|
||||||
|
envoy = handleTest ./envoy.nix {};
|
||||||
ergo = handleTest ./ergo.nix {};
|
ergo = handleTest ./ergo.nix {};
|
||||||
ergochat = handleTest ./ergochat.nix {};
|
ergochat = handleTest ./ergochat.nix {};
|
||||||
etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
|
etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
|
||||||
|
|
33
nixos/tests/envoy.nix
Normal file
33
nixos/tests/envoy.nix
Normal file
|
@ -0,0 +1,33 @@
|
||||||
|
import ./make-test-python.nix ({ pkgs, lib, ...} : {
|
||||||
|
name = "envoy";
|
||||||
|
meta = with pkgs.lib.maintainers; {
|
||||||
|
maintainers = [ cameronnemo ];
|
||||||
|
};
|
||||||
|
|
||||||
|
nodes.machine = { pkgs, ... }: {
|
||||||
|
services.envoy.enable = true;
|
||||||
|
services.envoy.settings = {
|
||||||
|
admin = {
|
||||||
|
access_log_path = "/dev/null";
|
||||||
|
address = {
|
||||||
|
socket_address = {
|
||||||
|
protocol = "TCP";
|
||||||
|
address = "127.0.0.1";
|
||||||
|
port_value = 9901;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
static_resources = {
|
||||||
|
listeners = [];
|
||||||
|
clusters = [];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
testScript = ''
|
||||||
|
machine.start()
|
||||||
|
machine.wait_for_unit("envoy.service")
|
||||||
|
machine.wait_for_open_port(9901)
|
||||||
|
machine.wait_until_succeeds("curl -fsS localhost:9901/ready")
|
||||||
|
'';
|
||||||
|
})
|
|
@ -127,8 +127,9 @@ buildBazelPackage rec {
|
||||||
];
|
];
|
||||||
|
|
||||||
passthru.tests = {
|
passthru.tests = {
|
||||||
# No tests for Envoy itself (yet), but it's tested as a core component of Pomerium.
|
envoy = nixosTests.envoy;
|
||||||
inherit (nixosTests) pomerium;
|
# tested as a core component of Pomerium
|
||||||
|
pomerium = nixosTests.pomerium;
|
||||||
};
|
};
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
|
|
Loading…
Reference in a new issue