feat(k-radius): Use LE certificates instead of self-signed ones

machines/vault01/_configuration.nix

@@ -20,6 +20,8 @@ lib.extra.mkConfig {
     ];
 
     services.netbird.enable = true;
+    services.nginx.enable = true;
+    networking.firewall.allowedTCPPorts = [ 80 ];
   };
 
   root = ./.;

machines/vault01/k-radius/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, ... }:
 
 {
   imports = [ ./module.nix ];
@@ -6,6 +6,8 @@
   services.k-radius = {
     enable = true;
 
+    domain = "radius.dgnum.eu";
+
     radiusClients = {
       ap = {
         ipaddr = "0.0.0.0/0";
@@ -47,16 +49,6 @@
     };
 
     authTokenFile = config.age.secrets."radius-auth_token_file".path;
-    privateKeyPasswordFile = config.age.secrets."radius-private_key_password_file".path;
-
-    certs = builtins.listToAttrs (
-      builtins.map (name: lib.nameValuePair name config.age.secrets."radius-${name}_pem_file".path) [
-        "ca"
-        "cert"
-        "dh"
-        "key"
-      ]
-    );
   };
 
   age-secrets.autoMatch = [ "radius" ];

machines/vault01/k-radius/module.nix

@@ -15,7 +15,16 @@ let
     mkIf
     mkOption
     optionalString
-    types
+    ;
+
+  inherit (lib.types)
+    attrsOf
+    bool
+    enum
+    package
+    path
+    str
+    submodule
     ;
 
   settingsFormat = pkgs.formats.toml { };
@@ -24,99 +33,94 @@ let
   rlm_python = pkgs.callPackage ./packages/rlm_python.nix { inherit pykanidm; };
 
   cfg = config.services.k-radius;
+
+  acmeDirectory = config.security.acme.certs.${cfg.domain}.directory;
 in
 {
   options.services.k-radius = {
     enable = mkEnableOption "a freeradius service linked to kanidm.";
 
+    domain = mkOption {
+      type = str;
+      description = "The domain used for the RADIUS server.";
+    };
+
+    raddb = mkOption {
+      type = path;
+      default = "/var/lib/radius/raddb/";
+      description = "The location of the raddb directory.";
+    };
+
     settings = mkOption { inherit (settingsFormat) type; };
 
     freeradius = mkOption {
-      type = types.package;
+      type = package;
       default = pkgs.freeradius.overrideAttrs (old: {
         buildInputs = (old.buildInputs or [ ]) ++ [ (pkgs.python3.withPackages (ps: [ ps.kanidm ])) ];
       });
     };
 
     configDir = mkOption {
-      type = types.path;
+      type = path;
       default = "/var/lib/radius/raddb";
       description = "The path of the freeradius server configuration directory.";
     };
 
     authTokenFile = mkOption {
-      type = types.path;
+      type = path;
       description = "File to the auth token for the service account.";
     };
 
     extra-mods = mkOption {
-      type = types.attrsOf types.path;
+      type = attrsOf path;
       default = { };
       description = "Additional files to be linked in mods-enabled.";
     };
 
     extra-sites = mkOption {
-      type = types.attrsOf types.path;
+      type = attrsOf path;
       default = { };
       description = "Additional files to be linked in sites-enabled.";
     };
 
     dictionary = mkOption {
-      type = types.attrsOf (
+      type = attrsOf (enum [
-        types.enum [
         "abinary"
         "date"
         "ipaddr"
         "integer"
         "string"
-        ]
+      ]);
-      );
       default = { };
       description = "Declare additionnal attributes to be listed in the dictionary.";
     };
 
     radiusClients = mkOption {
-      type = types.attrsOf (
+      type = attrsOf (submodule {
-        types.submodule {
         options = {
-            secret = mkOption { type = types.path; };
+          secret = mkOption { type = path; };
-            ipaddr = mkOption { type = types.str; };
+          ipaddr = mkOption { type = str; };
         };
-        }
+      });
-      );
       default = { };
       description = "A mapping of clients and their authentication tokens.";
     };
 
-    certs = {
-      ca = mkOption {
-        type = types.str;
-        description = "The signing CA of the RADIUS certificate.";
-      };
-      dh = mkOption {
-        type = types.str;
-        description = "The output of `openssl dhparam -in ca.pem -out dh.pem 2048`.";
-      };
-      cert = mkOption {
-        type = types.str;
-        description = "The certificate for the RADIUS server.";
-      };
-      key = mkOption {
-        type = types.str;
-        description = "The signing key for the RADIUS certificate.";
-      };
-    };
-
-    privateKeyPasswordFile = mkOption { type = types.path; };
-
     checkConfiguration = mkOption {
-      type = types.bool;
+      type = bool;
       description = "Check the configuration before starting the deamon. Useful for debugging.";
       default = false;
     };
   };
 
   config = mkIf cfg.enable {
+    # Certificate setup
+    services.nginx.virtualHosts.${cfg.domain} = {
+      http2 = false;
+      enableACME = true;
+      forceSSL = true;
+    };
+
     users = {
       users.radius = {
         group = "radius";
@@ -127,49 +131,45 @@ in
       groups.radius = { };
     };
 
-    services.k-radius.settings = {
-      ca_path = cfg.certs.ca;
-
-      radius_cert_path = cfg.certs.cert;
-      radius_key_path = cfg.certs.key;
-      radius_dh_path = cfg.certs.dh;
-      radius_ca_path = cfg.certs.ca;
-    };
-
     systemd.services.radius = {
       description = "FreeRadius server";
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [
+        "network.target"
+        "acme-finished-${cfg.domain}.target"
+      ];
       wants = [ "network.target" ];
       startLimitIntervalSec = 20;
       startLimitBurst = 5;
 
       preStart = ''
-        rm -rf ${cfg.configDir}
+        raddb=${cfg.raddb}
-        mkdir -p ${cfg.configDir}
 
-        cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* ${cfg.configDir}
+        # Recreate the configuration directory
-        cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* ${cfg.configDir}
+        rm -rf $raddb && mkdir -p $raddb
 
-        chmod -R u+w ${cfg.configDir}
+        cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* $raddb
+        cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* $raddb
+
+        chmod -R u+w $raddb
 
         # disable auth via methods kanidm doesn't support
-        rm ${cfg.configDir}/mods-available/sql
+        rm $raddb/mods-available/sql
-        rm ${cfg.configDir}/mods-enabled/{passwd,totp}
+        rm $raddb/mods-enabled/{passwd,totp}
 
         # enable the python and cache modules
-        ln -nsf ${cfg.configDir}/mods-available/python3 ${cfg.configDir}/mods-enabled/python3
+        ln -nsf $raddb/mods-available/python3 $raddb/mods-enabled/python3
-        ln -nsf ${cfg.configDir}/sites-available/check-eap-tls ${cfg.configDir}/sites-enabled/check-eap-tls
+        ln -nsf $raddb/sites-available/check-eap-tls $raddb/sites-enabled/check-eap-tls
 
         # write the clients configuration
-        rm ${cfg.configDir}/clients.conf && touch ${cfg.configDir}/clients.conf
+        > $raddb/clients.conf
         ${builtins.concatStringsSep "\n" (
           builtins.attrValues (
             builtins.mapAttrs (
               name:
               { secret, ipaddr }:
               ''
-                cat <<EOF >> ${cfg.configDir}/clients.conf
+                cat <<EOF >> $raddb/clients.conf
                 client ${name} {
                     ipaddr = ${ipaddr}
                     secret = $(cat "${secret}")
@@ -190,19 +190,16 @@ in
         chmod u+w /var/lib/radius/kanidm.toml
 
         # Copy the certificates to the correct directory
-        rm -rf ${cfg.configDir}/certs && mkdir -p ${cfg.configDir}/certs
+        rm -rf $raddb/certs && mkdir -p $raddb/certs
 
-        cp ${cfg.certs.ca} ${cfg.configDir}/certs/ca.pem
+        cp ${acmeDirectory}/chain.pem $raddb/certs/ca.pem
 
-        ${pkgs.openssl}/bin/openssl rehash ${cfg.configDir}/certs
+        ${lib.getExe pkgs.openssl} rehash $raddb/certs
 
-        cp ${cfg.certs.dh} ${cfg.configDir}/certs/dh.pem
+        # Recreate the dh.pem file
+        ${lib.getExe pkgs.openssl} dhparam -in $raddb/certs/ca.pem -out $raddb/certs/dh.pem 2048
 
-        cat ${cfg.certs.cert} ${cfg.certs.key} > ${cfg.configDir}/certs/server.pem
+        cp ${acmeDirectory}/full.pem $raddb/certs/server.pem
-
-        # Write the password of the private_key in the eap module
-        sed -i ${cfg.configDir}/mods-available/eap \
-          -e "s/whatever/$(cat "${cfg.privateKeyPasswordFile}")/"
 
         # Link the dictionary
         ln -nsf ${
@@ -213,22 +210,20 @@ in
               )
             )
           )
-        } ${cfg.configDir}/dictionary
+        } $raddb/dictionary
 
         # Link extra-mods
         ${builtins.concatStringsSep "\n" (
-          mapAttrsToList (name: path: "ln -nsf ${path} ${cfg.configDir}/mods-enabled/${name}") cfg.extra-mods
+          mapAttrsToList (name: path: "ln -nsf ${path} $raddb/mods-enabled/${name}") cfg.extra-mods
         )}
 
         # Link extra-sites
         ${builtins.concatStringsSep "\n" (
-          mapAttrsToList (
+          mapAttrsToList (name: path: "ln -nsf ${path} $raddb/sites-enabled/${name}") cfg.extra-sites
-            name: path: "ln -nsf ${path} ${cfg.configDir}/sites-enabled/${name}"
-          ) cfg.extra-sites
         )}
 
         # Check the configuration
-        ${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d ${cfg.configDir} -l stdout"}
+        ${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d $raddb -l stdout"}
       '';
 
       path = [
@@ -236,25 +231,28 @@ in
         pkgs.gnused
       ];
 
+      environment = {
+        KANIDM_RLM_CONFIG = "/var/lib/radius/kanidm.toml";
+        PYTHONPATH = rlm_python.pythonPath;
+      };
+
       serviceConfig = {
-        ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d ${cfg.configDir} -l stdout";
+        ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d /var/lib/radius/raddb -l stdout";
         ExecReload = [
-          "${cfg.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout"
+          "${cfg.freeradius}/bin/radiusd -C -d /var/lib/radius/raddb -l stdout"
           "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
         ];
-        User = "radius";
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
-        Group = "radius";
         DynamicUser = true;
+        Group = "radius";
+        LogsDirectory = "radius";
+        ReadOnlyPaths = [ acmeDirectory ];
         Restart = "on-failure";
         RestartSec = 2;
-        LogsDirectory = "radius";
-        StateDirectory = "radius";
         RuntimeDirectory = "radius";
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        StateDirectory = "radius";
-        Environment = [
+        SupplementaryGroups = [ "nginx" ];
-          "KANIDM_RLM_CONFIG=/var/lib/radius/kanidm.toml"
+        User = "radius";
-          "PYTHONPATH=${rlm_python.pythonPath}"
-        ];
       };
     };
   };