From 720d11b3d2fea637c737bf212a209349e39fb33d Mon Sep 17 00:00:00 2001 From: catvayor Date: Wed, 11 Jun 2025 17:14:30 +0200 Subject: [PATCH] feat(nimbolus): init a http terraform backend --- machines/nixos/compute01/_configuration.nix | 1 + machines/nixos/compute01/nimbolus.nix | 39 +++++++ .../nixos/compute01/secrets/nimbolus-kms_key | Bin 0 -> 1804 bytes .../compute01/secrets/nimbolus-s3_access | Bin 0 -> 1787 bytes .../compute01/secrets/nimbolus-s3_secret | Bin 0 -> 1797 bytes machines/nixos/compute01/secrets/secrets.nix | 3 + meta/dns.nix | 1 + modules/nixos/default.nix | 3 +- modules/nixos/nimbolus-tf.nix | 108 ++++++++++++++++++ 9 files changed, 154 insertions(+), 1 deletion(-) create mode 100644 machines/nixos/compute01/nimbolus.nix create mode 100644 machines/nixos/compute01/secrets/nimbolus-kms_key create mode 100644 machines/nixos/compute01/secrets/nimbolus-s3_access create mode 100644 machines/nixos/compute01/secrets/nimbolus-s3_secret create mode 100644 modules/nixos/nimbolus-tf.nix diff --git a/machines/nixos/compute01/_configuration.nix b/machines/nixos/compute01/_configuration.nix index 7e45eea..6689130 100644 --- a/machines/nixos/compute01/_configuration.nix +++ b/machines/nixos/compute01/_configuration.nix @@ -28,6 +28,7 @@ lib.extra.mkConfig { "mastodon" # "netbox" "nextcloud" + "nimbolus" "ollama-proxy" "opengist" "outline" diff --git a/machines/nixos/compute01/nimbolus.nix b/machines/nixos/compute01/nimbolus.nix new file mode 100644 index 0000000..6b2b78b --- /dev/null +++ b/machines/nixos/compute01/nimbolus.nix @@ -0,0 +1,39 @@ +# SPDX-FileCopyrightText: 2025 Lubin Bailly +# +# SPDX-License-Identifier: EUPL-1.2 + +{ + pkgs, + sources, + config, + ... +}: +let + host = "nimbolus.dgnum.eu"; + port = 9008; +in +{ + services.nimbolus-tf = { + enable = true; + package = (import sources.kat-pkgs { inherit pkgs; }).nimbolus-tf-backend; + environment = { + LISTEN_ADDR = "127.0.0.1:${toString port}"; + STORAGE_BACKEND = "s3"; + STORAGE_S3_ENDPOINT = "s3.dgnum.eu"; + STORAGE_S3_USE_SSL = "true"; + STORAGE_S3_BUCKET = "monorepo-terraform-state"; + + # TODO: configure openBAO + # AUTH_BASIC_ENABLED = "false"; + # AUTH_JWT_OIDC_ISSUER_URL = "https://vault.dgnum.eu/v1/identity/oidc"; + }; + secretEnvironment = { + KMS_KEY = config.age.secrets."nimbolus-kms_key".path; + STORAGE_S3_ACCESS_KEY = config.age.secrets."nimbolus-s3_access".path; + STORAGE_S3_SECRET_KEY = config.age.secrets."nimbolus-s3_secret".path; + }; + }; + dgn-web.simpleProxies.nimbolus = { + inherit host port; + }; +} diff --git a/machines/nixos/compute01/secrets/nimbolus-kms_key b/machines/nixos/compute01/secrets/nimbolus-kms_key new file mode 100644 index 0000000000000000000000000000000000000000..323599072b3853d415189c01168ab67f7ae8e010 GIT binary patch literal 1804 zcmZXUxvu;M8O7-$3_=7c{q)0)cYEBR*dBYljQ8E5@pwF5$NL^BLP#_q0jW~t1>gw~ zqKTB`1yUfWD50VS2?{R7pW@Pf&F?!$=bR`_UXnWQw|2~%`opGA!5Ic#esmay>?OG) zI1W>XP;9VrIRqf%?IMwb%#oG_jTwwg-*q<#?b(5|fl@Wi4pyXgl@@4vU#%Ec$S?=vgZ+QF@#qf+raBu(!0fSGj>c z2ur15!ou?VL=ozJB8p2^Q%BKe^P7j#Px36V5YAt4W&x_0PSaC1nTFoNO|}K*NS~im z>CcLSL+jmG3zRlVxxu)%v_kYBI(=vrEAq0bQ!B>_ueng{kx5-GNx3n@#E*^PSKF*i znzK0oS9t!A9$&>0d=+3rf_53aUlrzwXAl?>W}LfGjahu20N=Vt~PEnbNX3&z3SX4s%tXSWuny@ZQ#Na%or{ zVj&aZI5c=m>yNbz8ixkFDP;o9%OebUqQ~zWuG|t0c^t=s-0w7Lr0gac9uYjvlt%R5>>M2E8X*sB2)>c9kP8e=4+Vl!Of z)hQzg#RetVzGD|WJNk8K>(}y%_A^eT7MBPsR*)+Gm`|N80!*S`hGH{0x*w30F?gQ7 z741y+&+P0LDH2m&;+I!{L0T`?RgW)JO-CO*mnX0}$0Kk(iTtU%Ky?O(^VM+~{%(en zF^(roabl*N3f}IWT?|W$tB?MyC6x3eR)0NjIyST&P%kb_PKvY+5Ew8d6Yw2zPAi+_ zMvssmwy8CWit|VGH6l(rqkHUjv5O8YBvj?1B7mZ%JH7WrR~H_%%QsN=tc#a`cbP}2 zp+u~uVp2;?3k}q~S`NES@EPogqtESJyUy_X0sq*2t97OD*2%^Q3EDX}-nsp50l;}N zV&hQoj>1;uoG>?`YTevSZCjTe48+`rwq$-)B1%PeZ`5b?V&3-rA@t*XrQgyZlOkVRa?x5Q&uYXZpS8eI^*)}XTwbB!&6CK@>5NsPkW9Zdt$NeVDPe=>|6DYKlyR_2q;+CQ>hX86d=ogJ&@?%5>( z?xdw&k{Ipch-3)XPk1^P0=T9`u{f&mHCGw3vFT}-|8D`tb0?YULDz)So!~oPhPZs- zwj?QoqXL_OW=vTuvOza)MVaiJHD`> z)(_2u+>H@ zZC=6F@-Kdh7qnA+EPRXS{Q~DY=iJ;^kVJ1${pz=N%$oW~O`n|RGxYZ3!!V?8QHbF9 znLhYpgB8m`_o<@iw`scKMOsvKv#963wgJC#h8{I3A5BJ&VWlP%kl1<6BQH+$9mY0o z-TjH{c$7>1)T!-6d`(6haEcQzllPHEpLBKxhZ!6t1eU!ey|mK)LWH{4x{g<{%c@FO z6q{bYQ`InIF$09h%BZXGHNqTwlOOjH7!Lokz(iOBdzUk`~VK^ zZRugzNnZL(2IukW!FQZ`PMDA_Q$a6*N^_?gSSgVi5Zp*`yv>?>cUy@TG3H1xB~!s# zI@Q8m1gW_<*Rn>4#P~?d#Ye1zL#ioRLl0B;6gP&;yz+#MMf<>stSY(@kz>Vm_>6gJ za05-~E=a=rdMQPbSmZThGa{`u5KSuQQiyZ&SdI<4j`){oMrks%abTnzDS2f#W^$$d ze&>}Ohuc|*%#zFD^K`-HlS-sl*jH+~FG3*qol(A*)eNgmhLa+Z81L8@rvDZuKt5lX z5M{KdlG&vlWmQ!mlOQrwsUQFsAkG5o87XdT;ez}wmk-*@1lRUTr;pi-enV85hdJ0t&2VUin;ry(Twn=mPo=%-jah5@*WKE6pamXCf%6V zQj+XzFZG9jb9^y!#|S==x8l8%Ts9Wlj5~F4i)!{BSSNyFc6xF2%k>R&V<6FHSHs2#YZ0oF{xs*=(t7<> znqg-yR?cJt{u=YGy@uS*j8F3}xgGW;myTQ~naLsCY_kLtIawa7*f-(QcO$$ix*qa7 zO~uygtIRdAlDwjzX}K$u15ezPc9KJ)8%IwQvVh$?GcvVV&9h}ry6@b^*Z*!?eEBWu zqhN>*=O3ou+iU004N!27)=8oRczfNi`brsPN>!l%q;t9TE*`bBJ%;AHyt-iWR7LQo zHQ!#{yHnoY4mFV=j2Z6m85M%Tl&g+e|i+IkthhaD=CDO!c<_+j;f4TkRC;$2U z-(UaA-_}2U_S;|l^LM}b2LI{rmh$T$`oU*^{OhMi`RcF!{JHY;Z&&~N<+r}`({FzI OeJ#b`{XX-vKl~R@l}pma<~AwP5E#IL)_z!H@TSc%Cpzo{}aWwr(og=11+2?H3q$ zdUrRD`BQR5FbpPlfzYDWxKn&@ylh-gjTe973KX&7mU5Uq)0lCD!&3l zd<$#Vgb&3^@-uHszMpzF(Tce?} z;Tq4iZcv$#+Fd=cMvchTEzF`kU53aSIrAKkDQyXQZH3y`m|h1KUr|7j26OVhGN_Ur)j19{G9C?^WnyP}%Fi9r5uAJ2jjm0$cVjA5@tsJAChbYjz%oAzs zocqMAhDPPoRBd^Bjc9}G&%?S^{s<|t@5Hmysia`#1khZD&D3>T)+2uZn1jVUD7Don zv}>-@TJpJGOfi&FfkZvm2C$L##tu~HqIGJkyU_ED7^X%OSU3pQ_4FxcWN$FkPtju5v)IGSl z^qyvzangxkbW8l3lGyHkxT|#?cp4{4Q10hzJw|HRp?#eJp=>L76(p1~mu9)=jw{r5 z!oA(7HZZZROCXIQ7Ab!eg)((Y9vkGko-zD*&||7KalpHQ%*`^^DqxWu8RtG-C;l7R z?w8ewja{7%EK?=snR==!i}u<%?HxjU|A zyNFf#!^6>QfhiXVJ;M%7fvF@$8cXTht-!=ZVN0`F4iK<4?Pa0;yhW)g(I^@b+$?!C z=sdZ(Ve60Ub(0^J)*Hw-J{dV>S!BD0RcALQW62bzquhsCI6I~84-f0O&u@2k4~lQL zRiX|y0rYGvZl?|9QEXFastZ__iNw6x4 zq~8Z(59eV>)%GbHl5k9RKlt%^2Z;c)p{?i#biS+#jgy9WZi2@iCytkUoX;)r z^z^j557^nf(J67wSm%74sGeJgh9tnGSI7S0X9A;{WQkhp2>A1N{`6De)gOhgUVZ)R zFGTbG-LL-e-xvRwmGAxX+aLVqlW%?c+I%ng^S^$W{pYv#tG|dl?(=v4{yKZ{vk&E8 w{PX=U-(`RI;g{`qfAag|M?ZfdfAx;+epbGI`SHL1da%E^eEqkVA61|J4@!hpDgXcg literal 0 HcmV?d00001 diff --git a/machines/nixos/compute01/secrets/secrets.nix b/machines/nixos/compute01/secrets/secrets.nix index 38fd800..e2c0571 100644 --- a/machines/nixos/compute01/secrets/secrets.nix +++ b/machines/nixos/compute01/secrets/secrets.nix @@ -25,6 +25,9 @@ "netbox-environment_file" "nextcloud-adminpass_file" "nextcloud-s3_secret_file" + "nimbolus-kms_key" + "nimbolus-s3_access" + "nimbolus-s3_secret" "opengist-environment_file" "outline-oidc_client_secret_file" "outline-smtp_password_file" diff --git a/meta/dns.nix b/meta/dns.nix index fa3fd56..f9aa64e 100644 --- a/meta/dns.nix +++ b/meta/dns.nix @@ -82,6 +82,7 @@ let "gist" # Opengist "grafana" # Grafana "netbox-v2" # Netbox + "nimbolus" # Nimbolus Terraform Backend "nms" # LibreNMS "pads" # Hedgedoc "pass" # Vaultwarden diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 0485145..1fa0209 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -37,8 +37,9 @@ "dgn-web" "django-apps" "extranix" - "openbao" "forgejo-multiuser-nix-runners" + "nimbolus-tf" + "openbao" ]) ++ [ "${sources.agenix}/modules/age.nix" diff --git a/modules/nixos/nimbolus-tf.nix b/modules/nixos/nimbolus-tf.nix new file mode 100644 index 0000000..01a8c3e --- /dev/null +++ b/modules/nixos/nimbolus-tf.nix @@ -0,0 +1,108 @@ +# SPDX-FileCopyrightText: 2025 Lubin Bailly +# +# SPDX-License-Identifier: EUPL-1.2 + +{ + lib, + config, + pkgs, + ... +}: +let + inherit (lib) + escapeShellArg + getExe + mkEnableOption + mkIf + mkOption + ; + inherit (lib.types) + attrsOf + package + path + str + ; + + # from nixpkgs, commit b1371135b5db3fcf728114d92d5bd0218109598a + # FIXME: Should be replaced by nixpkgs lib when going to nixos-25.05 + concatMapAttrsStringSep = + sep: f: attrs: + lib.concatStringsSep sep (lib.attrValues (lib.mapAttrs f attrs)); + + cfg = config.services.nimbolus-tf; +in +{ + options.services.nimbolus-tf = { + enable = mkEnableOption "the nimbolus terraform http backend"; + package = mkOption { + type = package; + description = '' + The hello package to use. + ''; + example = "kat-pkgs.nimbolus-tf-backend"; + }; + environment = mkOption { + type = attrsOf str; + default = { }; + description = '' + Environment variables for nimbolus configuration. + ''; + }; + secretEnvironment = mkOption { + type = attrsOf path; + default = { }; + description = '' + Files for secret environment variables for nimbolus configuration. + ''; + }; + }; + config = mkIf cfg.enable { + systemd.services."nimbolus-tf" = { + description = "Nimbolus terraform http backend"; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + EnvironmentFile = "-/run/nimbolus-tf/env-file"; + ExecStart = "${getExe cfg.package}"; + ExecStartPre = "+${pkgs.writeShellScript "nimbolus-prestart" '' + echo -n > /run/nimbolus-tf/env-file + ${concatMapAttrsStringSep "\n" ( + key: value: "echo ${escapeShellArg "${key}=${value}"} >> /run/nimbolus-tf/env-file" + ) cfg.environment} + ${concatMapAttrsStringSep "\n" ( + key: value: ''echo "${key}=$(cat ${value})" >> /run/nimbolus-tf/env-file'' + ) cfg.secretEnvironment} + chmod a+r /run/nimbolus-tf/env-file + ''}"; + + RuntimeDirectory = "nimbolus-tf"; + RuntimeDirectoryMode = "0700"; + StateDirectory = "nimbolus-tf"; + StateDirectoryMode = "0700"; + WorkingDirectory = "/var/lib/nimbolus-tf"; + + # Hardening + DynamicUser = true; + CapabilityBoundingSet = ""; + PrivateDevices = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + RestrictNamespaces = true; + ProtectHostname = true; + LockPersonality = true; + RestrictRealtime = true; + ProtectHome = true; + ProtectProc = "noaccess"; + ProcSubset = "pid"; + PrivateUsers = true; + UMask = "0077"; + ProtectKernelTunables = true; + RestrictAddressFamilies = "AF_INET AF_INET6"; + SystemCallFilter = "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap"; + MemoryDenyWriteExecute = true; + SystemCallArchitectures = "native"; + }; + }; + }; +}