From 8a42e18d98bcd19cc395d61fb8df5281819562f0 Mon Sep 17 00:00:00 2001 From: Tom Hubrecht Date: Sun, 1 Sep 2024 15:40:59 +0200 Subject: [PATCH] feat(k-radius): Use LE certificates instead of self-signed ones --- machines/vault01/_configuration.nix | 2 + machines/vault01/k-radius/default.nix | 14 +- machines/vault01/k-radius/module.nix | 182 +++++++++++++------------- 3 files changed, 95 insertions(+), 103 deletions(-) diff --git a/machines/vault01/_configuration.nix b/machines/vault01/_configuration.nix index f55bb8e..bea9622 100644 --- a/machines/vault01/_configuration.nix +++ b/machines/vault01/_configuration.nix @@ -20,6 +20,8 @@ lib.extra.mkConfig { ]; services.netbird.enable = true; + services.nginx.enable = true; + networking.firewall.allowedTCPPorts = [ 80 ]; }; root = ./.; diff --git a/machines/vault01/k-radius/default.nix b/machines/vault01/k-radius/default.nix index ccfc23b..26352a0 100644 --- a/machines/vault01/k-radius/default.nix +++ b/machines/vault01/k-radius/default.nix @@ -1,4 +1,4 @@ -{ config, lib, ... }: +{ config, ... }: { imports = [ ./module.nix ]; @@ -6,6 +6,8 @@ services.k-radius = { enable = true; + domain = "radius.dgnum.eu"; + radiusClients = { ap = { ipaddr = "0.0.0.0/0"; @@ -47,16 +49,6 @@ }; authTokenFile = config.age.secrets."radius-auth_token_file".path; - privateKeyPasswordFile = config.age.secrets."radius-private_key_password_file".path; - - certs = builtins.listToAttrs ( - builtins.map (name: lib.nameValuePair name config.age.secrets."radius-${name}_pem_file".path) [ - "ca" - "cert" - "dh" - "key" - ] - ); }; age-secrets.autoMatch = [ "radius" ]; diff --git a/machines/vault01/k-radius/module.nix b/machines/vault01/k-radius/module.nix index ac83bc0..940af25 100644 --- a/machines/vault01/k-radius/module.nix +++ b/machines/vault01/k-radius/module.nix @@ -15,7 +15,16 @@ let mkIf mkOption optionalString - types + ; + + inherit (lib.types) + attrsOf + bool + enum + package + path + str + submodule ; settingsFormat = pkgs.formats.toml { }; @@ -24,99 +33,94 @@ let rlm_python = pkgs.callPackage ./packages/rlm_python.nix { inherit pykanidm; }; cfg = config.services.k-radius; + + acmeDirectory = config.security.acme.certs.${cfg.domain}.directory; in { options.services.k-radius = { enable = mkEnableOption "a freeradius service linked to kanidm."; + domain = mkOption { + type = str; + description = "The domain used for the RADIUS server."; + }; + + raddb = mkOption { + type = path; + default = "/var/lib/radius/raddb/"; + description = "The location of the raddb directory."; + }; + settings = mkOption { inherit (settingsFormat) type; }; freeradius = mkOption { - type = types.package; + type = package; default = pkgs.freeradius.overrideAttrs (old: { buildInputs = (old.buildInputs or [ ]) ++ [ (pkgs.python3.withPackages (ps: [ ps.kanidm ])) ]; }); }; configDir = mkOption { - type = types.path; + type = path; default = "/var/lib/radius/raddb"; description = "The path of the freeradius server configuration directory."; }; authTokenFile = mkOption { - type = types.path; + type = path; description = "File to the auth token for the service account."; }; extra-mods = mkOption { - type = types.attrsOf types.path; + type = attrsOf path; default = { }; description = "Additional files to be linked in mods-enabled."; }; extra-sites = mkOption { - type = types.attrsOf types.path; + type = attrsOf path; default = { }; description = "Additional files to be linked in sites-enabled."; }; dictionary = mkOption { - type = types.attrsOf ( - types.enum [ - "abinary" - "date" - "ipaddr" - "integer" - "string" - ] - ); + type = attrsOf (enum [ + "abinary" + "date" + "ipaddr" + "integer" + "string" + ]); default = { }; description = "Declare additionnal attributes to be listed in the dictionary."; }; radiusClients = mkOption { - type = types.attrsOf ( - types.submodule { - options = { - secret = mkOption { type = types.path; }; - ipaddr = mkOption { type = types.str; }; - }; - } - ); + type = attrsOf (submodule { + options = { + secret = mkOption { type = path; }; + ipaddr = mkOption { type = str; }; + }; + }); default = { }; description = "A mapping of clients and their authentication tokens."; }; - certs = { - ca = mkOption { - type = types.str; - description = "The signing CA of the RADIUS certificate."; - }; - dh = mkOption { - type = types.str; - description = "The output of `openssl dhparam -in ca.pem -out dh.pem 2048`."; - }; - cert = mkOption { - type = types.str; - description = "The certificate for the RADIUS server."; - }; - key = mkOption { - type = types.str; - description = "The signing key for the RADIUS certificate."; - }; - }; - - privateKeyPasswordFile = mkOption { type = types.path; }; - checkConfiguration = mkOption { - type = types.bool; + type = bool; description = "Check the configuration before starting the deamon. Useful for debugging."; default = false; }; }; config = mkIf cfg.enable { + # Certificate setup + services.nginx.virtualHosts.${cfg.domain} = { + http2 = false; + enableACME = true; + forceSSL = true; + }; + users = { users.radius = { group = "radius"; @@ -127,49 +131,45 @@ in groups.radius = { }; }; - services.k-radius.settings = { - ca_path = cfg.certs.ca; - - radius_cert_path = cfg.certs.cert; - radius_key_path = cfg.certs.key; - radius_dh_path = cfg.certs.dh; - radius_ca_path = cfg.certs.ca; - }; - systemd.services.radius = { description = "FreeRadius server"; wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; + after = [ + "network.target" + "acme-finished-${cfg.domain}.target" + ]; wants = [ "network.target" ]; startLimitIntervalSec = 20; startLimitBurst = 5; preStart = '' - rm -rf ${cfg.configDir} - mkdir -p ${cfg.configDir} + raddb=${cfg.raddb} - cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* ${cfg.configDir} - cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* ${cfg.configDir} + # Recreate the configuration directory + rm -rf $raddb && mkdir -p $raddb - chmod -R u+w ${cfg.configDir} + cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* $raddb + cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* $raddb + + chmod -R u+w $raddb # disable auth via methods kanidm doesn't support - rm ${cfg.configDir}/mods-available/sql - rm ${cfg.configDir}/mods-enabled/{passwd,totp} + rm $raddb/mods-available/sql + rm $raddb/mods-enabled/{passwd,totp} # enable the python and cache modules - ln -nsf ${cfg.configDir}/mods-available/python3 ${cfg.configDir}/mods-enabled/python3 - ln -nsf ${cfg.configDir}/sites-available/check-eap-tls ${cfg.configDir}/sites-enabled/check-eap-tls + ln -nsf $raddb/mods-available/python3 $raddb/mods-enabled/python3 + ln -nsf $raddb/sites-available/check-eap-tls $raddb/sites-enabled/check-eap-tls # write the clients configuration - rm ${cfg.configDir}/clients.conf && touch ${cfg.configDir}/clients.conf + > $raddb/clients.conf ${builtins.concatStringsSep "\n" ( builtins.attrValues ( builtins.mapAttrs ( name: { secret, ipaddr }: '' - cat <> ${cfg.configDir}/clients.conf + cat <> $raddb/clients.conf client ${name} { ipaddr = ${ipaddr} secret = $(cat "${secret}") @@ -190,19 +190,16 @@ in chmod u+w /var/lib/radius/kanidm.toml # Copy the certificates to the correct directory - rm -rf ${cfg.configDir}/certs && mkdir -p ${cfg.configDir}/certs + rm -rf $raddb/certs && mkdir -p $raddb/certs - cp ${cfg.certs.ca} ${cfg.configDir}/certs/ca.pem + cp ${acmeDirectory}/chain.pem $raddb/certs/ca.pem - ${pkgs.openssl}/bin/openssl rehash ${cfg.configDir}/certs + ${lib.getExe pkgs.openssl} rehash $raddb/certs - cp ${cfg.certs.dh} ${cfg.configDir}/certs/dh.pem + # Recreate the dh.pem file + ${lib.getExe pkgs.openssl} dhparam -in $raddb/certs/ca.pem -out $raddb/certs/dh.pem 2048 - cat ${cfg.certs.cert} ${cfg.certs.key} > ${cfg.configDir}/certs/server.pem - - # Write the password of the private_key in the eap module - sed -i ${cfg.configDir}/mods-available/eap \ - -e "s/whatever/$(cat "${cfg.privateKeyPasswordFile}")/" + cp ${acmeDirectory}/full.pem $raddb/certs/server.pem # Link the dictionary ln -nsf ${ @@ -213,22 +210,20 @@ in ) ) ) - } ${cfg.configDir}/dictionary + } $raddb/dictionary # Link extra-mods ${builtins.concatStringsSep "\n" ( - mapAttrsToList (name: path: "ln -nsf ${path} ${cfg.configDir}/mods-enabled/${name}") cfg.extra-mods + mapAttrsToList (name: path: "ln -nsf ${path} $raddb/mods-enabled/${name}") cfg.extra-mods )} # Link extra-sites ${builtins.concatStringsSep "\n" ( - mapAttrsToList ( - name: path: "ln -nsf ${path} ${cfg.configDir}/sites-enabled/${name}" - ) cfg.extra-sites + mapAttrsToList (name: path: "ln -nsf ${path} $raddb/sites-enabled/${name}") cfg.extra-sites )} # Check the configuration - ${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d ${cfg.configDir} -l stdout"} + ${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d $raddb -l stdout"} ''; path = [ @@ -236,25 +231,28 @@ in pkgs.gnused ]; + environment = { + KANIDM_RLM_CONFIG = "/var/lib/radius/kanidm.toml"; + PYTHONPATH = rlm_python.pythonPath; + }; + serviceConfig = { - ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d ${cfg.configDir} -l stdout"; + ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d /var/lib/radius/raddb -l stdout"; ExecReload = [ - "${cfg.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout" + "${cfg.freeradius}/bin/radiusd -C -d /var/lib/radius/raddb -l stdout" "${pkgs.coreutils}/bin/kill -HUP $MAINPID" ]; - User = "radius"; - Group = "radius"; + AmbientCapabilities = "CAP_NET_BIND_SERVICE"; DynamicUser = true; + Group = "radius"; + LogsDirectory = "radius"; + ReadOnlyPaths = [ acmeDirectory ]; Restart = "on-failure"; RestartSec = 2; - LogsDirectory = "radius"; - StateDirectory = "radius"; RuntimeDirectory = "radius"; - AmbientCapabilities = "CAP_NET_BIND_SERVICE"; - Environment = [ - "KANIDM_RLM_CONFIG=/var/lib/radius/kanidm.toml" - "PYTHONPATH=${rlm_python.pythonPath}" - ]; + StateDirectory = "radius"; + SupplementaryGroups = [ "nginx" ]; + User = "radius"; }; }; };