From 964799e556222b5115ca61823fd671488f8e718d Mon Sep 17 00:00:00 2001 From: Christian Albrecht Date: Tue, 22 Aug 2017 12:27:00 +0200 Subject: [PATCH] sks and pgpkeyserver-lite modules: init (#27515) * modules sks and pgpkeyserver-lite: runs the sks keyserver with optional nginx proxy for webgui. * Add calbrecht to maintainers * module sks: fix default hkpAddress value * module pgpkeyserver-lite: make hkpAddress a string type option and use (builtins.head services.sks.hkpAddress) as default value * module sks: remove leftover service dependencies --- lib/maintainers.nix | 1 + nixos/modules/module-list.nix | 2 + nixos/modules/services/security/sks.nix | 82 +++++++++++++++++++ .../services/web-apps/pgpkeyserver-lite.nix | 75 +++++++++++++++++ .../web-apps/pgpkeyserver-lite/default.nix | 25 ++++++ pkgs/top-level/all-packages.nix | 2 + 6 files changed, 187 insertions(+) create mode 100644 nixos/modules/services/security/sks.nix create mode 100644 nixos/modules/services/web-apps/pgpkeyserver-lite.nix create mode 100644 pkgs/servers/web-apps/pgpkeyserver-lite/default.nix diff --git a/lib/maintainers.nix b/lib/maintainers.nix index 2bbb56aab5e..d44c3ac0d8b 100644 --- a/lib/maintainers.nix +++ b/lib/maintainers.nix @@ -89,6 +89,7 @@ bstrik = "Berno Strik "; bzizou = "Bruno Bzeznik "; c0dehero = "CodeHero "; + calbrecht = "Christian Albrecht "; calrama = "Moritz Maxeiner "; calvertvl = "Victor Calvert "; campadrenalin = "Philip Horger "; diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index bfc554cc936..b1efa10aecd 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -556,6 +556,7 @@ ./services/security/oauth2_proxy.nix ./services/security/physlock.nix ./services/security/shibboleth-sp.nix + ./services/security/sks.nix ./services/security/sshguard.nix ./services/security/tor.nix ./services/security/torify.nix @@ -583,6 +584,7 @@ ./services/web-apps/frab.nix ./services/web-apps/mattermost.nix ./services/web-apps/nixbot.nix + ./services/web-apps/pgpkeyserver-lite.nix ./services/web-apps/piwik.nix ./services/web-apps/pump.io.nix ./services/web-apps/tt-rss.nix diff --git a/nixos/modules/services/security/sks.nix b/nixos/modules/services/security/sks.nix new file mode 100644 index 00000000000..62308428f32 --- /dev/null +++ b/nixos/modules/services/security/sks.nix @@ -0,0 +1,82 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.services.sks; + + sksPkg = cfg.package; + +in + +{ + + options = { + + services.sks = { + + enable = mkEnableOption "sks"; + + package = mkOption { + default = pkgs.sks; + defaultText = "pkgs.sks"; + type = types.package; + description = " + Which sks derivation to use. + "; + }; + + hkpAddress = mkOption { + default = [ "127.0.0.1" "::1" ]; + type = types.listOf types.str; + description = " + Wich ip addresses the sks-keyserver is listening on. + "; + }; + + hkpPort = mkOption { + default = 11371; + type = types.int; + description = " + Which port the sks-keyserver is listening on. + "; + }; + }; + }; + + config = mkIf cfg.enable { + + environment.systemPackages = [ sksPkg ]; + + users.users.sks = { + createHome = true; + home = "/var/db/sks"; + isSystemUser = true; + shell = "${pkgs.coreutils}/bin/true"; + }; + + systemd.services = let + hkpAddress = "'" + (builtins.concatStringsSep " " cfg.hkpAddress) + "'" ; + hkpPort = builtins.toString cfg.hkpPort; + home = config.users.users.sks.home; + user = config.users.users.sks.name; + in { + sks-keyserver = { + wantedBy = [ "multi-user.target" ]; + preStart = '' + mkdir -p ${home}/dump + ${pkgs.sks}/bin/sks build ${home}/dump/*.gpg -n 10 -cache 100 || true #*/ + ${pkgs.sks}/bin/sks cleandb || true + ${pkgs.sks}/bin/sks pbuild -cache 20 -ptree_cache 70 || true + ''; + serviceConfig = { + WorkingDirectory = home; + User = user; + Restart = "always"; + ExecStart = "${pkgs.sks}/bin/sks db -hkp_address ${hkpAddress} -hkp_port ${hkpPort}"; + }; + }; + }; + }; +} diff --git a/nixos/modules/services/web-apps/pgpkeyserver-lite.nix b/nixos/modules/services/web-apps/pgpkeyserver-lite.nix new file mode 100644 index 00000000000..93f69bd1265 --- /dev/null +++ b/nixos/modules/services/web-apps/pgpkeyserver-lite.nix @@ -0,0 +1,75 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.services.pgpkeyserver-lite; + sksCfg = config.services.sks; + + webPkg = cfg.package; + +in + +{ + + options = { + + services.pgpkeyserver-lite = { + + enable = mkEnableOption "pgpkeyserver-lite on a nginx vHost proxying to a gpg keyserver"; + + package = mkOption { + default = pkgs.pgpkeyserver-lite; + defaultText = "pkgs.pgpkeyserver-lite"; + type = types.package; + description = " + Which webgui derivation to use. + "; + }; + + hostname = mkOption { + type = types.str; + description = " + Which hostname to set the vHost to that is proxying to sks. + "; + }; + + hkpAddress = mkOption { + default = builtins.head sksCfg.hkpAddress; + type = types.str; + description = " + Wich ip address the sks-keyserver is listening on. + "; + }; + + hkpPort = mkOption { + default = sksCfg.hkpPort; + type = types.int; + description = " + Which port the sks-keyserver is listening on. + "; + }; + }; + }; + + config = mkIf cfg.enable { + + services.nginx.enable = true; + + services.nginx.virtualHosts = let + hkpPort = builtins.toString cfg.hkpPort; + in { + "${cfg.hostname}" = { + root = webPkg; + locations = { + "/pks".extraConfig = '' + proxy_pass http://${cfg.hkpAddress}:${hkpPort}; + proxy_pass_header Server; + add_header Via "1.1 ${cfg.hostname}"; + ''; + }; + }; + }; + }; +} diff --git a/pkgs/servers/web-apps/pgpkeyserver-lite/default.nix b/pkgs/servers/web-apps/pgpkeyserver-lite/default.nix new file mode 100644 index 00000000000..c4f49b36bf8 --- /dev/null +++ b/pkgs/servers/web-apps/pgpkeyserver-lite/default.nix @@ -0,0 +1,25 @@ +{ stdenv, fetchFromGitHub, lib } : + +stdenv.mkDerivation rec { + name = "pgpkeyserver-lite-${version}"; + version = "2017-07-18"; + + src = fetchFromGitHub { + owner = "mattrude"; + repo = "pgpkeyserver-lite"; + rev = "a038cb7"; + sha256 = "12pn92pcpv38b2gmamppn9yzdn7x52pgxnzpal22gqsxwimhs2rx"; + }; + + installPhase = '' + mkdir -p $out + cp -R 404.html assets favicon.ico index.html robots.txt $out + ''; + + meta = { + homepage = https://github.com/mattrude/pgpkeyserver-lite; + description = "A lightweight static front-end for a sks keyserver."; + license = lib.licenses.gpl3; + maintainers = [ lib.maintainers.calbrecht ]; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3a881d28e51..2f97b8a49f1 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8154,6 +8154,8 @@ with pkgs; pgpdump = callPackage ../tools/security/pgpdump { }; + pgpkeyserver-lite = callPackage ../servers/web-apps/pgpkeyserver-lite {}; + gpgstats = callPackage ../tools/security/gpgstats { }; gpshell = callPackage ../development/tools/misc/gpshell { };