summaryrefslogtreecommitdiff
path: root/nixos/modules
diff options
context:
space:
mode:
authorKarel Kočí <cynerd@email.cz>2022-04-09 10:17:34 +0200
committerKarel Kočí <cynerd@email.cz>2022-04-09 10:17:34 +0200
commitbd9812fab0daea5f0911047a70494dc25089ac79 (patch)
treea96d9955b6aee8c5dcc435c551a5c2c724dd945e /nixos/modules
downloadnixsentinel-bd9812fab0daea5f0911047a70494dc25089ac79.tar.gz
nixsentinel-bd9812fab0daea5f0911047a70494dc25089ac79.tar.bz2
nixsentinel-bd9812fab0daea5f0911047a70494dc25089ac79.zip
Initial versionHEADmaster
This was taken from nixturris.
Diffstat (limited to 'nixos/modules')
-rw-r--r--nixos/modules/sentinel-faillogs.nix36
-rw-r--r--nixos/modules/sentinel-fwlogs.nix41
-rw-r--r--nixos/modules/sentinel-minipot.nix72
-rw-r--r--nixos/modules/sentinel.nix60
4 files changed, 209 insertions, 0 deletions
diff --git a/nixos/modules/sentinel-faillogs.nix b/nixos/modules/sentinel-faillogs.nix
new file mode 100644
index 0000000..93ade14
--- /dev/null
+++ b/nixos/modules/sentinel-faillogs.nix
@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+ imports = [ ./sentinel.nix ];
+
+
+ options = {
+ services.sentinel.faillogs = {
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Whether to enable the Turris Sentinel Fail logs collector.
+ The services.sentinel.enable has to be enabled as well.
+ '';
+ };
+ };
+ };
+
+
+ config = mkIf config.services.sentinel.enable && config.services.sentinel.faillogs.enable {
+ environment.systemPackages = [ pkgs.sentinel-faillogs ];
+
+ systemd.services.sentinel-faillogs = {
+ description = "Turris Sentinel Fail Logs";
+ wantedBy = [ "multi-user.target" ];
+ path = [ pkgs.sentinel-faillogs ];
+ serviceConfig.ExecStart = "${pkgs.sentinel-faillogs}/bin/sentinel-faillogs";
+ };
+
+ };
+
+}
diff --git a/nixos/modules/sentinel-fwlogs.nix b/nixos/modules/sentinel-fwlogs.nix
new file mode 100644
index 0000000..d2bc864
--- /dev/null
+++ b/nixos/modules/sentinel-fwlogs.nix
@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+ imports = [ ./sentinel.nix ];
+
+
+ options = {
+ services.sentinel.fwlogs = {
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Whether to enable the Turris Sentinel Firewall logs collector.
+ The services.sentinel.enable has to be enabled as well.
+ '';
+ };
+ nflog-group = mkOption {
+ type = types.port;
+ default = 1914;
+ description = "Netfilter log group used to pass logs to sentinel-fwlogs.";
+ };
+ };
+ };
+
+
+ config = mkIf config.services.sentinel.enable && config.services.sentinel.fwlogs.enable {
+ environment.systemPackages = [ pkgs.sentinel-fwlogs ];
+
+ systemd.services.sentinel-fwlogs = {
+ description = "Turris Sentinel Firewall Logs";
+ wantedBy = [ "multi-user.target" ];
+ path = [ pkgs.sentinel-fwlogs ];
+ serviceConfig.ExecStart = "${pkgs.sentinel-fwlogs}/bin/sentinel-fwlogs";
+ };
+
+ };
+
+}
diff --git a/nixos/modules/sentinel-minipot.nix b/nixos/modules/sentinel-minipot.nix
new file mode 100644
index 0000000..8dcf370
--- /dev/null
+++ b/nixos/modules/sentinel-minipot.nix
@@ -0,0 +1,72 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+ cnf = config.sentinel.minipot;
+ inherit (pkgs) sentinel-minipot;
+
+ minipotOpts = { name, port }: {
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Whether to enable the Turris Sentinel ${name} Minipot.
+ The services.sentinel.enable and service.sentinel.minipot.enable have to be enabled as well.
+ '';
+ };
+ port = mkOption {
+ type = types.port;
+ default = port;
+ description = "The port ${name} minipot should bind to.";
+ };
+ };
+
+in {
+
+ imports = [ ./sentinel.nix ];
+
+ options = {
+ services.sentinel.minipot = {
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Whether to enable the Turris Sentinel Minipot system.
+ The services.sentinel.enable has to be enabled as well.
+ '';
+ };
+
+ http = minipotOpts { name = "HTTP"; port = 8033; };
+ ftp = minipotOpts { name = "FTP"; port = 2133; };
+ smtp = minipotOpts { name = "SMTP"; port = 5873; };
+ telnet = minipotOpts { name = "Telnet"; port = 2333; };
+ };
+ };
+
+
+ config = mkIf (config.services.sentinel.enable && cnf.enable) {
+ assertions = [
+ {
+ assertion = cnf.http.enable || cnf.ftp.enable || cnf.smtp.enable || cnf.telnet.enable;
+ message = "Sentinel minipot requires at least one of the protocols to be enabled";
+ }
+ ];
+
+ environment.systemPackages = [ sentinel-minipot ];
+
+ systemd.services.sentinel-minipot = {
+ description = "Turris Sentinel Minipot";
+ wantedBy = [ "multi-user.target" ];
+ path = [ sentinel-minipot ];
+ serviceConfig.ExecStart = "${sentinel-minipot}/bin/sentinel-minipot"
+ + optionalString cnf.http.enable " --http=${cnf.http.port}"
+ + optionalString cnf.ftp.enable " --ftp=${cnf.ftp.port}"
+ + optionalString cnf.smtp.enable " --smtp=${cnf.smtp.port}"
+ + optionalString cnf.telnet.enable " --telnet=${cnf.telnet.port}";
+ };
+
+ };
+
+}
diff --git a/nixos/modules/sentinel.nix b/nixos/modules/sentinel.nix
new file mode 100644
index 0000000..19ef746
--- /dev/null
+++ b/nixos/modules/sentinel.nix
@@ -0,0 +1,60 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+ cnf = config.sentinel;
+
+in {
+
+ options = {
+
+ services.sentinel = {
+
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable the Turris Sentinel attact prevention system.
+ '';
+ };
+ deviceToken = mkOption {
+ type = types.str;
+ description = ''
+ Turris Sentinel token. You can use `sentinel-device-token -c` to get new one.
+ '';
+ };
+ sentinelCA = mkOption {
+ type = types.path;
+ default = ../sentinel-ca.pem;
+ description = ''
+ The CA certificate used with Sentinel.
+ Most of the times you do not want to modify this as it uses the
+ certificate shipped with NixOS modules.
+ '';
+ };
+
+ };
+
+ };
+
+
+ config = mkIf config.services.sentinel.enable {
+ environment.systemPackages = with pkgs; [
+ sentinel-proxy sentinel-certgen
+ ];
+
+ # TODO we should probably rather pass token using configuration file
+ systemd.services.sentinel-proxy = {
+ description = "Turris Sentinel proxy";
+ wantedBy = [ "multi-user.target" ];
+ path = [ sentinel-proxy ];
+ serviceConfig.ExecStart = "${sentinel-proxy}/bin/sentinel-proxy"
+ + "--ca=${cnf.sentinelCA}"
+ + " --token=${cnf.deviceToken}";
+ };
+
+ };
+
+}