movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 14:10:33 +03:00
Code Activity

Merge pull request #296459 from MinerSebas/restic-rest-server-hardening

Browse source 
nixos/restic-rest-server:  Add additional service hardening
This commit is contained in:
Pascal Bach 2024-04-10 23:33:34 +02:00 • committed by GitHub
commit a8eaee11a9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 159 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nixos/modules/services/backup/restic-rest-server.nix
View file

@ -12,7 +12,7 @@ in
enable = mkEnableOption (lib.mdDoc "Restic REST Server");
listenAddress = mkOption {
default = ":8000";
default = "8000";
example = "127.0.0.1:8080";
type = types.str;
description = lib.mdDoc "Listen on a specific IP address and port.";
@ -61,14 +61,19 @@ in
};
config = mkIf cfg.enable {
assertions = [{
assertion = lib.substring 0 1 cfg.listenAddress != ":";
message = "The restic-rest-server now uses systemd socket activation, which expects only the Port number: services.restic.server.listenAddress = \"${lib.substring 1 6 cfg.listenAddress}\";";
}];
systemd.services.restic-rest-server = {
description = "Restic REST Server";
after = [ "network.target" ];
after = [ "network.target" "restic-rest-server.socket" ];
requires = [ "restic-rest-server.socket" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = ''
${cfg.package}/bin/rest-server \
--listen ${cfg.listenAddress} \
--path ${cfg.dataDir} \
${optionalString cfg.appendOnly "--append-only"} \
${optionalString cfg.privateRepos "--private-repos"} \
@ -80,16 +85,40 @@ in
Group = "restic";
# Security hardening
ReadWritePaths = [ cfg.dataDir ];
CapabilityBoundingSet = "";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateNetwork = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
PrivateDevices = true;
ReadWritePaths = [ cfg.dataDir ];
RemoveIPC = true;
RestrictAddressFamilies = "none";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
UMask = 027;
};
};
systemd.sockets.restic-rest-server = {
listenStreams = [ cfg.listenAddress ];
wantedBy = [ "sockets.target" ];
};
systemd.tmpfiles.rules = mkIf cfg.privateRepos [
"f ${cfg.dataDir}/.htpasswd 0700 restic restic -"
];