start a cryptpad module

machines/core-services-01/subZone.nix

@@ -17,7 +17,7 @@ with my.ipv6; # contains { standard, acme }
   SOA = {
     nameServer = "ns1.${my.subZone}.";
     adminEmail = my.email;
-    serial = 2021111301; # Y M D Version
+    serial = 2021111400; # Y M D Version
   };
 
   NS = [
@@ -60,9 +60,15 @@ with my.ipv6; # contains { standard, acme }
       home.A = upstream-v4-proxies;
       home.AAAA = public-cof-ips;
       pads.AAAA = public-cof-ips;
+      pads.subdomains = {
+        api.AAAA = public-cof-ips;
+        files.AAAA = public-cof-ips;
+        sandbox.AAAA = public-cof-ips;
+      };
       docs.AAAA = public-cof-ips;
     };
 
+
     internal.subdomains = {
       # Routers
       router01.A = [ "10.1.1.1" ];

machines/public-cof/configuration.nix

@@ -12,6 +12,7 @@
       ./minecraft.nix
       # ./factorio.nix # TODO
       ./nginx.nix
+      # ./cryptpad.nix
       ./hedgedoc.nix
       # TODO monitoring
     ];

machines/public-cof/cryptpad.js

@@ -0,0 +1,316 @@
+/* globals module */
+
+/*  DISCLAIMER:
+    There are two recommended methods of running a CryptPad instance:
+    1. Using a standalone nodejs server without HTTPS (suitable for local development)
+    2. Using NGINX to serve static assets and to handle HTTPS for API server's websocket traffic
+    We do not officially recommend or support Apache, Docker, Kubernetes, Traefik, or any other configuration.
+    Support requests for such setups should be directed to their authors.
+    If you're having difficulty difficulty configuring your instance
+    we suggest that you join the project's IRC/Matrix channel.
+    If you don't have any difficulty configuring your instance and you'd like to
+    support us for the work that went into making it pain-free we are quite happy
+    to accept donations via our opencollective page: https://opencollective.com/cryptpad
+*/
+module.exports = {
+/*  CryptPad is designed to serve its content over two domains.
+ *  Account passwords and cryptographic content is handled on the 'main' domain,
+ *  while the user interface is loaded on a 'sandbox' domain
+ *  which can only access information which the main domain willingly shares.
+ *
+ *  In the event of an XSS vulnerability in the UI (that's bad)
+ *  this system prevents attackers from gaining access to your account (that's good).
+ *
+ *  Most problems with new instances are related to this system blocking access
+ *  because of incorrectly configured sandboxes. If you only see a white screen
+ *  when you try to load CryptPad, this is probably the cause.
+ *
+ *  PLEASE READ THE FOLLOWING COMMENTS CAREFULLY.
+ *
+ */
+
+/*  httpUnsafeOrigin is the URL that clients will enter to load your instance.
+ *  Any other URL that somehow points to your instance is supposed to be blocked.
+ *  The default provided below assumes you are loading CryptPad from a server
+ *  which is running on the same machine, using port 3000.
+ *
+ *  In a production instance this should be available ONLY over HTTPS
+ *  using the default port for HTTPS (443) ie. https://cryptpad.fr
+ *  In such a case this should be handled by NGINX, as documented in
+ *  cryptpad/docs/example.nginx.conf (see the $main_domain variable)
+ *
+ */
+    httpUnsafeOrigin: 'http://localhost:3000/',
+
+/*  httpSafeOrigin is the URL that is used for the 'sandbox' described above.
+ *  If you're testing or developing with CryptPad on your local machine then
+ *  it is appropriate to leave this blank. The default behaviour is to serve
+ *  the main domain over port 3000 and to serve the content over port 3001.
+ *
+ *  This is not appropriate in a production environment where invasive networks
+ *  may filter traffic going over abnormal ports.
+ *  To correctly configure your production instance you must provide a URL
+ *  with a different domain (a subdomain is sufficient).
+ *  It will be used to load the UI in our 'sandbox' system.
+ *
+ *  This value corresponds to the $sandbox_domain variable
+ *  in the example nginx file.
+ *
+ *  CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
+ */
+    // httpSafeOrigin: "https://some-other-domain.xyz",
+
+/*  httpAddress specifies the address on which the nodejs server
+ *  should be accessible. By default it will listen on 127.0.0.1
+ *  (IPv4 localhost on most systems). If you want it to listen on
+ *  all addresses, including IPv6, set this to '::'.
+ *
+ */
+    //httpAddress: '::',
+
+/*  httpPort specifies on which port the nodejs server should listen.
+ *  By default it will serve content over port 3000, which is suitable
+ *  for both local development and for use with the provided nginx example,
+ *  which will proxy websocket traffic to your node server.
+ *
+ */
+    //httpPort: 3000,
+
+/*  httpSafePort allows you to specify an alternative port from which
+ *  the node process should serve sandboxed assets. The default value is
+ *  that of your httpPort + 1. You probably don't need to change this.
+ *
+ */
+    //httpSafePort: 3001,
+
+/*  CryptPad will launch a child process for every core available
+ *  in order to perform CPU-intensive tasks in parallel.
+ *  Some host environments may have a very large number of cores available
+ *  or you may want to limit how much computing power CryptPad can take.
+ *  If so, set 'maxWorkers' to a positive integer.
+ */
+    // maxWorkers: 4,
+
+    /* =====================
+     *         Admin
+     * ===================== */
+
+    /*
+     *  CryptPad contains an administration panel. Its access is restricted to specific
+     *  users using the following list.
+     *  To give access to the admin panel to a user account, just add their user id,
+     *  which can be found on the settings page for registered users.
+     *  Entries should be strings separated by a comma.
+     */
+/*
+    adminKeys: [
+        //"https://my.awesome.website/user/#/1/cryptpad-user1/YZgXQxKR0Rcb6r6CmxHPdAGLVludrAF2lEnkbx1vVOo=",
+    ],
+*/
+
+    /*  CryptPad's administration panel includes a "support" tab
+     *  wherein administrators with a secret key can view messages
+     *  sent from users via the encrypted forms on the /support/ page
+     *
+     *  To enable this functionality:
+     *    run `node ./scripts/generate-admin-keys.js`
+     *    save the public key in your config in the value below
+     *    add the private key via the admin panel
+     *    and back it up in a secure manner
+     *
+     */
+    // supportMailboxPublicKey: "",
+
+    /*  We're very proud that CryptPad is available to the public as free software!
+     *  We do, however, still need to pay our bills as we develop the platform.
+     *
+     *  By default CryptPad will prompt users to consider donating to
+     *  our OpenCollective campaign. We publish the state of our finances periodically
+     *  so you can decide for yourself whether our expenses are reasonable.
+     *
+     *  You can disable any solicitations for donations by setting 'removeDonateButton' to true,
+     *  but we'd appreciate it if you didn't!
+     */
+    //removeDonateButton: false,
+
+    /*  CryptPad will display a point of contact for your instance on its contact page
+     *  (/contact.html) if you provide it below.
+     */
+    adminEmail: 'club-reseau@lists.ens.psl.eu',
+
+    /*
+     *  By default, CryptPad contacts one of our servers once a day.
+     *  This check-in will also send some very basic information about your instance including its
+     *  version and the adminEmail so we can reach you if we are aware of a serious problem.
+     *  We will never sell it or send you marketing mail.
+     *
+     *  If you want to block this check-in and remain set 'blockDailyCheck' to true.
+     */
+    //blockDailyCheck: false,
+
+    /*
+     *  By default users get 50MB of storage by registering on an instance.
+     *  You can set this value to whatever you want.
+     *
+     *  hint: 50MB is 50 * 1024 * 1024
+     */
+    //defaultStorageLimit: 50 * 1024 * 1024,
+
+
+    /* =====================
+     *        STORAGE
+     * ===================== */
+
+    /*  Pads that are not 'pinned' by any registered user can be set to expire
+     *  after a configurable number of days of inactivity (default 90 days).
+     *  The value can be changed or set to false to remove expiration.
+     *  Expired pads can then be removed using a cron job calling the
+     *  `evict-inactive.js` script with node
+     *
+     *  defaults to 90 days if nothing is provided
+     */
+    //inactiveTime: 90, // days
+
+    /*  CryptPad archives some data instead of deleting it outright.
+     *  This archived data still takes up space and so you'll probably still want to
+     *  remove these files after a brief period.
+     *
+     *  cryptpad/scripts/evict-inactive.js is intended to be run daily
+     *  from a crontab or similar scheduling service.
+     *
+     *  The intent with this feature is to provide a safety net in case of accidental
+     *  deletion. Set this value to the number of days you'd like to retain
+     *  archived data before it's removed permanently.
+     *
+     *  defaults to 15 days if nothing is provided
+     */
+    //archiveRetentionTime: 15,
+
+    /*  Max Upload Size (bytes)
+     *  this sets the maximum size of any one file uploaded to the server.
+     *  anything larger than this size will be rejected
+     *  defaults to 20MB if no value is provided
+     */
+    //maxUploadSize: 20 * 1024 * 1024,
+
+    /*
+     *  CryptPad allows administrators to give custom limits to their friends.
+     *  add an entry for each friend, identified by their user id,
+     *  which can be found on the settings page. Include a 'limit' (number of bytes),
+     *  a 'plan' (string), and a 'note' (string).
+     *
+     *  hint: 1GB is 1024 * 1024 * 1024 bytes
+     */
+/*
+    customLimits: {
+        "https://my.awesome.website/user/#/1/cryptpad-user1/YZgXQxKR0Rcb6r6CmxHPdAGLVludrAF2lEnkbx1vVOo=": {
+            limit: 20 * 1024 * 1024 * 1024,
+            plan: 'insider',
+            note: 'storage space donated by my.awesome.website'
+        },
+        "https://my.awesome.website/user/#/1/cryptpad-user2/GdflkgdlkjeworijfkldfsdflkjeEAsdlEnkbx1vVOo=": {
+            limit: 10 * 1024 * 1024 * 1024,
+            plan: 'insider',
+            note: 'storage space donated by my.awesome.website'
+        }
+    },
+*/
+
+    /*  Users with premium accounts (those with a plan included in their customLimit)
+     *  can benefit from an increased upload size limit. By default they are restricted to the same
+     *  upload size as any other registered user.
+     *
+     */
+    //premiumUploadSize: 100 * 1024 * 1024,
+
+    /* =====================
+     *   DATABASE VOLUMES
+     * ===================== */
+
+    /*
+     *  CryptPad stores each document in an individual file on your hard drive.
+     *  Specify a directory where files should be stored.
+     *  It will be created automatically if it does not already exist.
+     */
+    filePath: './datastore/',
+
+    /*  CryptPad offers the ability to archive data for a configurable period
+     *  before deleting it, allowing a means of recovering data in the event
+     *  that it was deleted accidentally.
+     *
+     *  To set the location of this archive directory to a custom value, change
+     *  the path below:
+     */
+    archivePath: './data/archive',
+
+    /*  CryptPad allows logged in users to request that particular documents be
+     *  stored by the server indefinitely. This is called 'pinning'.
+     *  Pin requests are stored in a pin-store. The location of this store is
+     *  defined here.
+     */
+    pinPath: './data/pins',
+
+    /*  if you would like the list of scheduled tasks to be stored in
+        a custom location, change the path below:
+    */
+    taskPath: './data/tasks',
+
+    /*  if you would like users' authenticated blocks to be stored in
+        a custom location, change the path below:
+    */
+    blockPath: './block',
+
+    /*  CryptPad allows logged in users to upload encrypted files. Files/blobs
+     *  are stored in a 'blob-store'. Set its location here.
+     */
+    blobPath: './blob',
+
+    /*  CryptPad stores incomplete blobs in a 'staging' area until they are
+     *  fully uploaded. Set its location here.
+     */
+    blobStagingPath: './data/blobstage',
+
+    /* CryptPad supports logging events directly to the disk in a 'logs' directory
+     * Set its location here, or set it to false (or nothing) if you'd rather not log
+     */
+    logPath: './data/logs',
+
+    /* =====================
+     *       Debugging
+     * ===================== */
+
+    /*  CryptPad can log activity to stdout
+     *  This may be useful for debugging
+     */
+    logToStdout: false,
+
+    /* CryptPad can be configured to log more or less
+     * the various settings are listed below by order of importance
+     *
+     * silly, verbose, debug, feedback, info, warn, error
+     *
+     * Choose the least important level of logging you wish to see.
+     * For example, a 'silly' logLevel will display everything,
+     * while 'info' will display 'info', 'warn', and 'error' logs
+     *
+     * This will affect both logging to the console and the disk.
+     */
+    logLevel: 'info',
+
+    /*  clients can use the /settings/ app to opt out of usage feedback
+     *  which informs the server of things like how much each app is being
+     *  used, and whether certain clientside features are supported by
+     *  the client's browser. The intent is to provide feedback to the admin
+     *  such that the service can be improved. Enable this with `true`
+     *  and ignore feedback with `false` or by commenting the attribute
+     *
+     *  You will need to set your logLevel to include 'feedback'. Set this
+     *  to false if you'd like to exclude feedback from your logs.
+     */
+    logFeedback: false,
+
+    /*  CryptPad supports verbose logging
+     *  (false by default)
+     */
+    verbose: false,
+};

machines/public-cof/cryptpad.nix

@@ -0,0 +1,190 @@
+{ ... }:
+let
+  subZone = "beta.rz.ens.wtf";
+  main_domain = "pads." + subZone;
+  api_domain = "api." + main_domain;
+  files_domain = "files." + main_domain;
+  sandbox_domain = "sandbox." + main_domain;
+in
+{
+  services.cryptpad = {
+    enable = true;
+    configFile = "/etc/cryptpad/config.js";
+  };
+  environment.etc."cryptpad/config.js".source = ./cryptpad.js;
+
+  services.nginx.virtualHosts = {
+    "docs.beta.rz.ens.wtf" = {
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        # CryptPad serves static assets over these two domains.
+        # `main_domain` is what users will enter in their address bar.
+        # Privileged computation such as key management is handled in this scope
+        # UI content is loaded via the `sandbox_domain`.
+        # "Content Security Policy" headers prevent content loaded via the sandbox
+        # from accessing privileged information.
+        # These variables must be different to take advantage of CryptPad's sandboxing techniques.
+        # In the event of an XSS vulnerability in CryptPad's front-end code
+        # this will limit the amount of information accessible to attackers.
+        set $main_domain ${main_domain};
+        set $sandbox_domain ${sandbox_domain};
+
+        # CryptPad's dynamic content (websocket traffic and encrypted blobs)
+        # can be served over separate domains. Using dedicated domains (or subdomains)
+        # for these purposes allows you to move them to a separate machine at a later date
+        # if you find that a single machine cannot handle all of your users.
+        # If you don't use dedicated domains, this can be the same as $main_domain
+        # If you do, they'll be added as exceptions to any rules which block connections to remote domains.
+        set $api_domain ${api_domain};
+        set $files_domain ${files_domain};
+
+
+        server_name ${main_domain} ${sandbox_domain};
+
+        # diffie-hellman parameters are used to negotiate keys for your session
+        # generate strong parameters using the following command
+        ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
+
+        # Speeds things up a little bit when resuming a session
+        ssl_session_timeout 5m;
+        ssl_session_cache shared:SSL:5m;
+
+        # You'll need nginx 1.13.0 or better to support TLSv1.3
+        ssl_protocols TLSv1.2 TLSv1.3;
+
+        # https://cipherli.st/
+        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
+        ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
+
+        # CSS can be dynamically set inline, loaded from the same domain, or from $main_domain
+        set $styleSrc   "'unsafe-inline' 'self' ${main_domain}";
+
+        # connect-src restricts URLs which can be loaded using script interfaces
+        set $connectSrc "'self' https://${main_domain} ${main_domain} https://${api_domain} blob: wss://${api_domain} ${api_domain} ${files_domain}";
+
+        # fonts can be loaded from data-URLs or the main domain
+        set $fontSrc    "'self' data: ${main_domain}";
+
+        # images can be loaded from anywhere, though we'd like to deprecate this as it allows the use of images for tracking
+        set $imgSrc     "'self' data: * blob: ${main_domain}";
+
+        # frame-src specifies valid sources for nested browsing contexts.
+        # this prevents loading any iframes from anywhere other than the sandbox domain
+        set $frameSrc   "'self' ${sandbox_domain} blob:";
+
+        # specifies valid sources for loading media using video or audio
+        set $mediaSrc   "'self' data: * blob: ${main_domain}";
+
+        # defines valid sources for webworkers and nested browser contexts
+        # deprecated in favour of worker-src and frame-src
+        set $childSrc   "https://${main_domain}";
+
+        # specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
+        # supercedes child-src but is unfortunately not yet universally supported.
+        set $workerSrc  "https://${main_domain}";
+
+        # script-src specifies valid sources for javascript, including inline handlers
+        set $scriptSrc  "'self' resource: ${main_domain}";
+
+        set $unsafe 0;
+        # the following assets are loaded via the sandbox domain
+        # they unfortunately still require exceptions to the sandboxing to work correctly.
+        if ($uri = "/pad/inner.html") { set $unsafe 1; }
+        if ($uri = "/sheet/inner.html") { set $unsafe 1; }
+        if ($uri ~ ^\/common\/onlyoffice\/.*\/index\.html.*$) { set $unsafe 1; }
+
+        # everything except the sandbox domain is a privileged scope, as they might be used to handle keys
+        if ($host != $sandbox_domain) { set $unsafe 0; }
+
+        # privileged contexts allow a few more rights than unprivileged contexts, though limits are still applied
+        if ($unsafe) {
+            set $scriptSrc "'self' 'unsafe-eval' 'unsafe-inline' resource: ${main_domain}";
+        }
+
+        # The nodejs process can handle all traffic whether accessed over websocket or as static assets
+        # We prefer to serve static content from nginx directly and to leave the API server to handle
+        # the dynamic content that only it can manage. This is primarily an optimization
+        location ^~ /cryptpad_websocket {
+            proxy_pass http://localhost:3000;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+            # WebSocket support (nginx 1.4)
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection upgrade;
+        }
+
+        location ^~ /customize.dist/ {
+            # This is needed in order to prevent infinite recursion between /customize/ and the root
+        }
+        # try to load customizeable content via /customize/ and fall back to the default content
+        # located at /customize.dist/
+        # This is what allows you to override behaviour.
+        location ^~ /customize/ {
+            rewrite ^/customize/(.*)$ $1 break;
+            try_files /customize/$uri /customize.dist/$uri;
+        }
+
+        # /api/config is loaded once per page load and is used to retrieve
+        # the caching variable which is applied to every other resource
+        # which is loaded during that session.
+        location = /api/config {
+            proxy_pass http://localhost:3000;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        # encrypted blobs are immutable and are thus cached for a year
+        location ^~ /blob/ {
+            if ($request_method = 'OPTIONS') {
+                add_header 'Access-Control-Allow-Origin' '*';
+                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+                add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
+                add_header 'Access-Control-Max-Age' 1728000;
+                add_header 'Content-Type' 'application/octet-stream; charset=utf-8';
+                add_header 'Content-Length' 0;
+                return 204;
+            }
+            add_header Cache-Control max-age=31536000;
+            add_header 'Access-Control-Allow-Origin' '*';
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+            add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
+            add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
+            try_files $uri =404;
+        }
+
+        # the "block-store" serves encrypted payloads containing users' drive keys
+        # these payloads are unlocked via login credentials. They are mutable
+        # and are thus never cached. They're small enough that it doesn't matter, in any case.
+        location ^~ /block/ {
+            add_header Cache-Control max-age=0;
+            try_files $uri =404;
+        }
+
+        # This block provides an alternative means of loading content
+        # otherwise only served via websocket. This is solely for debugging purposes,
+        # and is thus not allowed by default.
+        #location ^~ /datastore/ {
+            #add_header Cache-Control max-age=0;
+            #try_files $uri =404;
+        #}
+
+        # The nodejs server has some built-in forwarding rules to prevent
+        # URLs like /pad from resulting in a 404. This simply adds a trailing slash
+        # to a variety of applications.
+        location ~ ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard|file|media|profile|contacts|todo|filepicker|debug|kanban|sheet|support|admin|notifications|teams)$ {
+            rewrite ^(.*)$ $1/ redirect;
+        }
+
+        # Finally, serve anything the above exceptions don't govern.
+        try_files /www/$uri /www/$uri/index.html /customize/$uri;
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 433 80 ];
+}