From ee61ab2b1bb06c72a52e98630325711158d33221 Mon Sep 17 00:00:00 2001 From: clerie Date: Thu, 2 Feb 2023 23:17:21 +0100 Subject: [PATCH] Update nixpkgs sources --- flake.lock | 6 +-- modules/chisel/default.nix | 97 -------------------------------------- modules/default.nix | 1 - 3 files changed, 3 insertions(+), 101 deletions(-) delete mode 100644 modules/chisel/default.nix diff --git a/flake.lock b/flake.lock index c049561..c5184c1 100644 --- a/flake.lock +++ b/flake.lock @@ -22,11 +22,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1667142599, - "narHash": "sha256-OLJxsg9VqfKjFkerOxWtNIkibsCvxsv5A8wNWO1MeWk=", + "lastModified": 1675183161, + "narHash": "sha256-Zq8sNgAxDckpn7tJo7V1afRSk2eoVbu3OjI1QklGLNg=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "412b9917cea092f3d39f9cd5dead4effd5bc4053", + "rev": "e1e1b192c1a5aab2960bf0a0bd53a2e8124fa18e", "type": "github" }, "original": { diff --git a/modules/chisel/default.nix b/modules/chisel/default.nix deleted file mode 100644 index 8c0ddf4..0000000 --- a/modules/chisel/default.nix +++ /dev/null @@ -1,97 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; - -let - cfg = config.services.chisel-server; - -in { - options = { - services.chisel-server = { - enable = mkEnableOption (mdDoc "Chisel Tunnel Server"); - host = mkOption { - description = mdDoc "Address to listen on, falls back to 0.0.0.0"; - type = with types; nullOr str; - default = null; - example = "[::1]"; - }; - port = mkOption { - description = mkDoc "Port to listen on, falls back to 8080"; - type = with types; nullOr int; - default = null; - }; - authfile = mkOption { - description = mdDoc "Path to auth.json file."; - type = with types; nullOr path; - default = null; - }; - keepalive = mkOption { - description = mdDoc "Keepalive interval, falls back to 25s"; - type = with types; nullOr str; - default = null; - example = "5s"; - }; - backend = mkOption { - description = mdDoc "HTTP server to proxy normal requests to"; - type = with types; nullOr str; - default = null; - example = "http://127.0.0.1:8080"; - }; - socks5 = mkOption { - description = mdDoc "Allow clients access to internal SOCKS5 proxy"; - type = types.bool; - default = false; - }; - reverse = mkOption { - description = "Allow clients reverse port forwarding"; - type = types.bool; - default = false; - }; - }; - }; - - config = { - systemd.services.chisel-server = mkIf cfg.enable { - description = "Chisel Tunnel Server"; - wantedBy = [ "network-online.target" ]; - - serviceConfig = { - ExecStart = "${pkgs.chisel}/bin/chisel server " + concatStringsSep " " ( - optional (cfg.host != null) "--host ${cfg.host}" - ++ optional (cfg.port != null) "--port ${builtins.toString cfg.port}" - ++ optional (cfg.authfile != null) "--authfile ${cfg.authfile}" - ++ optional (cfg.keepalive != null) "--keepalive ${cfg.keepalive}" - ++ optional (cfg.backend != null) "--backend ${cfg.backend}" - ++ optional cfg.socks5 "--socks5" - ++ optional cfg.reverse "--reverse" - ); - - # Security Hardening - # Refer to systemd.exec(5) for option descriptions. - CapabilityBoundingSet = ""; - - # implies RemoveIPC=, PrivateTmp=, NoNewPrivileges=, RestrictSUIDSGID=, - # ProtectSystem=strict, ProtectHome=read-only - DynamicUser = true; - LockPersonality = true; - PrivateDevices = true; - PrivateUsers = true; - ProcSubset = "pid"; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectProc = "invisible"; - ProtectKernelModules = true; - ProtectKernelTunables = true; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; - RestrictNamespaces = true; - RestrictRealtime = true; - SystemCallArchitectures = "native"; - SystemCallFilter = "~@clock @cpu-emulation @debug @mount @obsolete @reboot @swap @privileged @resources"; - UMask = "0077"; - }; - }; - }; -} diff --git a/modules/default.nix b/modules/default.nix index 112288f..eea78e0 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -5,7 +5,6 @@ ./policyrouting ./akne ./anycast_healthchecker - ./chisel ./gre-tunnel ./minecraft-server ./monitoring