feat: add config file to webnsupdate
Move flags to config file, and add more options. Mirror some in the module.
This commit is contained in:
parent
3d660314cf
commit
316f2bf576
GPG key ID:
F016B9E770737A0B
17 changed files with 641 additions and 532 deletions
|
|
@ -3,10 +3,18 @@
|
|||
imports = [
|
||||
inputs.treefmt-nix.flakeModule
|
||||
./package.nix
|
||||
./module.nix
|
||||
./tests.nix
|
||||
];
|
||||
|
||||
flake.nixosModules =
|
||||
let
|
||||
webnsupdate = ../module.nix;
|
||||
in
|
||||
{
|
||||
default = webnsupdate;
|
||||
inherit webnsupdate;
|
||||
};
|
||||
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,208 +0,0 @@
|
|||
let
|
||||
module =
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.webnsupdate;
|
||||
inherit (lib)
|
||||
mkOption
|
||||
mkEnableOption
|
||||
mkPackageOption
|
||||
types
|
||||
;
|
||||
in
|
||||
{
|
||||
options.services.webnsupdate = mkOption {
|
||||
description = "An HTTP server for nsupdate.";
|
||||
default = { };
|
||||
type = types.submodule {
|
||||
options = {
|
||||
enable = mkEnableOption "webnsupdate";
|
||||
extraArgs = mkOption {
|
||||
description = ''
|
||||
Extra arguments to be passed to the webnsupdate server command.
|
||||
'';
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
example = [ "--ip-source" ];
|
||||
};
|
||||
package = mkPackageOption pkgs "webnsupdate" { };
|
||||
bindIp = mkOption {
|
||||
description = ''
|
||||
IP address to bind to.
|
||||
|
||||
Setting it to anything other than localhost is very insecure as
|
||||
`webnsupdate` only supports plain HTTP and should always be behind a
|
||||
reverse proxy.
|
||||
'';
|
||||
type = types.str;
|
||||
default = "localhost";
|
||||
example = "0.0.0.0";
|
||||
};
|
||||
bindPort = mkOption {
|
||||
description = "Port to bind to.";
|
||||
type = types.port;
|
||||
default = 5353;
|
||||
};
|
||||
allowedIPVersion = mkOption {
|
||||
description = ''The allowed IP versions to accept updates from.'';
|
||||
type = types.enum [
|
||||
"both"
|
||||
"ipv4-only"
|
||||
"ipv6-only"
|
||||
];
|
||||
default = "both";
|
||||
example = "ipv4-only";
|
||||
};
|
||||
passwordFile = mkOption {
|
||||
description = ''
|
||||
The file where the password is stored.
|
||||
|
||||
This file can be created by running `webnsupdate mkpasswd $USERNAME $PASSWORD`.
|
||||
'';
|
||||
type = types.path;
|
||||
example = "/secrets/webnsupdate.pass";
|
||||
};
|
||||
keyFile = mkOption {
|
||||
description = ''
|
||||
The TSIG key that `nsupdate` should use.
|
||||
|
||||
This file will be passed to `nsupdate` through the `-k` option, so look
|
||||
at `man 8 nsupdate` for information on the key's format.
|
||||
'';
|
||||
type = types.path;
|
||||
example = "/secrets/webnsupdate.key";
|
||||
};
|
||||
ttl = mkOption {
|
||||
description = "The TTL that should be set on the zone records created by `nsupdate`.";
|
||||
type = types.ints.positive;
|
||||
default = 60;
|
||||
example = 3600;
|
||||
};
|
||||
records = mkOption {
|
||||
description = ''
|
||||
The fqdn of records that should be updated.
|
||||
|
||||
Empty lines will be ignored, but whitespace will not be.
|
||||
'';
|
||||
type = types.nullOr types.lines;
|
||||
default = null;
|
||||
example = ''
|
||||
example.com.
|
||||
|
||||
example.org.
|
||||
ci.example.org.
|
||||
'';
|
||||
};
|
||||
recordsFile = mkOption {
|
||||
description = ''
|
||||
The fqdn of records that should be updated.
|
||||
|
||||
Empty lines will be ignored, but whitespace will not be.
|
||||
'';
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
example = "/secrets/webnsupdate.records";
|
||||
};
|
||||
user = mkOption {
|
||||
description = "The user to run as.";
|
||||
type = types.str;
|
||||
default = "named";
|
||||
};
|
||||
group = mkOption {
|
||||
description = "The group to run as.";
|
||||
type = types.str;
|
||||
default = "named";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config =
|
||||
let
|
||||
recordsFile =
|
||||
if cfg.recordsFile != null then cfg.recordsFile else pkgs.writeText "webnsrecords" cfg.records;
|
||||
args = lib.strings.escapeShellArgs (
|
||||
[
|
||||
"--records"
|
||||
recordsFile
|
||||
"--key-file"
|
||||
cfg.keyFile
|
||||
"--password-file"
|
||||
cfg.passwordFile
|
||||
"--address"
|
||||
cfg.bindIp
|
||||
"--ip-type"
|
||||
cfg.allowedIPVersion
|
||||
"--port"
|
||||
(builtins.toString cfg.bindPort)
|
||||
"--ttl"
|
||||
(builtins.toString cfg.ttl)
|
||||
"--data-dir=%S/webnsupdate"
|
||||
]
|
||||
++ cfg.extraArgs
|
||||
);
|
||||
cmd = "${lib.getExe cfg.package} ${args}";
|
||||
in
|
||||
lib.mkIf cfg.enable {
|
||||
# warnings =
|
||||
# lib.optional (!config.services.bind.enable) "`webnsupdate` is expected to be used alongside `bind`. This is an unsupported configuration.";
|
||||
assertions = [
|
||||
{
|
||||
assertion =
|
||||
(cfg.records != null || cfg.recordsFile != null)
|
||||
&& !(cfg.records != null && cfg.recordsFile != null);
|
||||
message = "Exactly one of `services.webnsupdate.records` and `services.webnsupdate.recordsFile` must be set.";
|
||||
}
|
||||
];
|
||||
|
||||
systemd.services.webnsupdate = {
|
||||
description = "Web interface for nsupdate.";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [
|
||||
"network.target"
|
||||
"bind.service"
|
||||
];
|
||||
preStart = "${cmd} verify";
|
||||
path = [ pkgs.dig ];
|
||||
startLimitIntervalSec = 60;
|
||||
serviceConfig = {
|
||||
ExecStart = [ cmd ];
|
||||
Type = "exec";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "10s";
|
||||
# User and group
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
# Runtime directory and mode
|
||||
RuntimeDirectory = "webnsupdate";
|
||||
RuntimeDirectoryMode = "0750";
|
||||
# Cache directory and mode
|
||||
CacheDirectory = "webnsupdate";
|
||||
CacheDirectoryMode = "0750";
|
||||
# Logs directory and mode
|
||||
LogsDirectory = "webnsupdate";
|
||||
LogsDirectoryMode = "0750";
|
||||
# State directory and mode
|
||||
StateDirectory = "webnsupdate";
|
||||
StateDirectoryMode = "0750";
|
||||
# New file permissions
|
||||
UMask = "0027";
|
||||
# Security
|
||||
NoNewPrivileges = true;
|
||||
ProtectHome = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
flake.nixosModules = {
|
||||
default = module;
|
||||
webnsupdate = module;
|
||||
};
|
||||
}
|
||||
|
|
@ -9,7 +9,7 @@
|
|||
lastIPPath = "/var/lib/webnsupdate/last-ip.json";
|
||||
|
||||
zoneFile = pkgs.writeText "${testDomain}.zoneinfo" ''
|
||||
$TTL 60 ; 1 minute
|
||||
$TTL 600 ; 10 minutes
|
||||
$ORIGIN ${testDomain}.
|
||||
@ IN SOA ns1.${testDomain}. admin.${testDomain}. (
|
||||
1 ; serial
|
||||
|
|
@ -73,20 +73,19 @@
|
|||
|
||||
webnsupdate = {
|
||||
enable = true;
|
||||
bindIp = lib.mkDefault "127.0.0.1";
|
||||
keyFile = "/etc/bind/rndc.key";
|
||||
# test:test (user:password)
|
||||
passwordFile = pkgs.writeText "webnsupdate.pass" "FQoNmuU1BKfg8qsU96F6bK5ykp2b0SLe3ZpB3nbtfZA";
|
||||
package = self'.packages.webnsupdate;
|
||||
extraArgs = [
|
||||
"-vvv" # debug messages
|
||||
"--ip-source=ConnectInfo"
|
||||
];
|
||||
records = ''
|
||||
test1.${testDomain}.
|
||||
test2.${testDomain}.
|
||||
test3.${testDomain}.
|
||||
'';
|
||||
extraArgs = [ "-vvv" ]; # debug messages
|
||||
settings = {
|
||||
address = lib.mkDefault "127.0.0.1:5353";
|
||||
key_file = "/etc/bind/rndc.key";
|
||||
password_file = pkgs.writeText "webnsupdate.pass" "FQoNmuU1BKfg8qsU96F6bK5ykp2b0SLe3ZpB3nbtfZA"; # test:test
|
||||
ip_source = lib.mkDefault "ConnectInfo";
|
||||
records = [
|
||||
"test1.${testDomain}."
|
||||
"test2.${testDomain}."
|
||||
"test3.${testDomain}."
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -97,7 +96,7 @@
|
|||
webnsupdate-ipv4-machine
|
||||
];
|
||||
|
||||
config.services.webnsupdate.bindIp = "::1";
|
||||
config.services.webnsupdate.settings.address = "[::1]:5353";
|
||||
};
|
||||
|
||||
webnsupdate-nginx-machine =
|
||||
|
|
@ -109,26 +108,26 @@
|
|||
|
||||
config.services = {
|
||||
# Use default IP Source
|
||||
webnsupdate.extraArgs = lib.mkForce [ "-vvv" ]; # debug messages
|
||||
webnsupdate.settings.ip_source = "RightmostXForwardedFor";
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
|
||||
virtualHosts.webnsupdate.locations."/".proxyPass =
|
||||
"http://${config.services.webnsupdate.bindIp}:${builtins.toString config.services.webnsupdate.bindPort}";
|
||||
"http://${config.services.webnsupdate.settings.address}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
webnsupdate-ipv4-only-machine = {
|
||||
imports = [ webnsupdate-nginx-machine ];
|
||||
config.services.webnsupdate.allowedIPVersion = "ipv4-only";
|
||||
config.services.webnsupdate.settings.ip_type = "Ipv4Only";
|
||||
};
|
||||
|
||||
webnsupdate-ipv6-only-machine = {
|
||||
imports = [ webnsupdate-nginx-machine ];
|
||||
config.services.webnsupdate.allowedIPVersion = "ipv6-only";
|
||||
config.services.webnsupdate.settings.ip_type = "Ipv6Only";
|
||||
};
|
||||
|
||||
# "A" for IPv4, "AAAA" for IPv6, "ANY" for any
|
||||
|
|
@ -158,9 +157,9 @@
|
|||
STATIC_DOMAINS: list[str] = ["${testDomain}", "ns1.${testDomain}", "nsupdate.${testDomain}"]
|
||||
DYNAMIC_DOMAINS: list[str] = ["test1.${testDomain}", "test2.${testDomain}", "test3.${testDomain}"]
|
||||
|
||||
def dig_cmd(domain: str, record: str, ip: str | None) -> str:
|
||||
match_ip = "" if ip is None else f"\\s\\+60\\s\\+IN\\s\\+{record}\\s\\+{ip}$"
|
||||
return f"dig @localhost {record} {domain} +noall +answer | grep '^{domain}.{match_ip}'"
|
||||
def dig_cmd(domain: str, record: str, ip: str | None) -> tuple[str, str]:
|
||||
match_ip = "" if ip is None else f"\\s\\+600\\s\\+IN\\s\\+{record}\\s\\+{ip}$"
|
||||
return f"dig @localhost {record} {domain} +noall +answer", f"grep '^{domain}.{match_ip}'"
|
||||
|
||||
def curl_cmd(domain: str, identity: str, path: str, query: dict[str, str]) -> str:
|
||||
from urllib.parse import urlencode
|
||||
|
|
@ -168,10 +167,16 @@
|
|||
return f"{CURL} -u {identity} -X GET 'http://{domain}{"" if NGINX else ":5353"}/{path}{q}'"
|
||||
|
||||
def domain_available(domain: str, record: str, ip: str | None=None):
|
||||
machine.succeed(dig_cmd(domain, record, ip))
|
||||
dig, grep = dig_cmd(domain, record, ip)
|
||||
rc, output = machine.execute(dig)
|
||||
print(f"{dig}[{rc}]: {output}")
|
||||
machine.succeed(f"{dig} | {grep}")
|
||||
|
||||
def domain_missing(domain: str, record: str, ip: str | None=None):
|
||||
machine.fail(dig_cmd(domain, record, ip))
|
||||
dig, grep = dig_cmd(domain, record, ip)
|
||||
rc, output = machine.execute(dig)
|
||||
print(f"{dig}[{rc}]: {output}")
|
||||
machine.fail(f"{dig} | {grep}")
|
||||
|
||||
def update_records(domain: str="localhost", /, *, path: str="update", **kwargs):
|
||||
machine.succeed(curl_cmd(domain, "test:test", path, kwargs))
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue