forked from DGNum/infrastructure
feat(k-radius): Use LE certificates instead of self-signed ones
This commit is contained in:
parent
3ca3ff8939
commit
8a42e18d98
SSH key fingerprint:
SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
3 changed files with 95 additions and 103 deletions
|
|
@ -20,6 +20,8 @@ lib.extra.mkConfig {
|
|||
];
|
||||
|
||||
services.netbird.enable = true;
|
||||
services.nginx.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
|
||||
root = ./.;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, ... }:
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
imports = [ ./module.nix ];
|
||||
|
|
@ -6,6 +6,8 @@
|
|||
services.k-radius = {
|
||||
enable = true;
|
||||
|
||||
domain = "radius.dgnum.eu";
|
||||
|
||||
radiusClients = {
|
||||
ap = {
|
||||
ipaddr = "0.0.0.0/0";
|
||||
|
|
@ -47,16 +49,6 @@
|
|||
};
|
||||
|
||||
authTokenFile = config.age.secrets."radius-auth_token_file".path;
|
||||
privateKeyPasswordFile = config.age.secrets."radius-private_key_password_file".path;
|
||||
|
||||
certs = builtins.listToAttrs (
|
||||
builtins.map (name: lib.nameValuePair name config.age.secrets."radius-${name}_pem_file".path) [
|
||||
"ca"
|
||||
"cert"
|
||||
"dh"
|
||||
"key"
|
||||
]
|
||||
);
|
||||
};
|
||||
|
||||
age-secrets.autoMatch = [ "radius" ];
|
||||
|
|
|
|||
|
|
@ -15,7 +15,16 @@ let
|
|||
mkIf
|
||||
mkOption
|
||||
optionalString
|
||||
types
|
||||
;
|
||||
|
||||
inherit (lib.types)
|
||||
attrsOf
|
||||
bool
|
||||
enum
|
||||
package
|
||||
path
|
||||
str
|
||||
submodule
|
||||
;
|
||||
|
||||
settingsFormat = pkgs.formats.toml { };
|
||||
|
|
@ -24,99 +33,94 @@ let
|
|||
rlm_python = pkgs.callPackage ./packages/rlm_python.nix { inherit pykanidm; };
|
||||
|
||||
cfg = config.services.k-radius;
|
||||
|
||||
acmeDirectory = config.security.acme.certs.${cfg.domain}.directory;
|
||||
in
|
||||
{
|
||||
options.services.k-radius = {
|
||||
enable = mkEnableOption "a freeradius service linked to kanidm.";
|
||||
|
||||
domain = mkOption {
|
||||
type = str;
|
||||
description = "The domain used for the RADIUS server.";
|
||||
};
|
||||
|
||||
raddb = mkOption {
|
||||
type = path;
|
||||
default = "/var/lib/radius/raddb/";
|
||||
description = "The location of the raddb directory.";
|
||||
};
|
||||
|
||||
settings = mkOption { inherit (settingsFormat) type; };
|
||||
|
||||
freeradius = mkOption {
|
||||
type = types.package;
|
||||
type = package;
|
||||
default = pkgs.freeradius.overrideAttrs (old: {
|
||||
buildInputs = (old.buildInputs or [ ]) ++ [ (pkgs.python3.withPackages (ps: [ ps.kanidm ])) ];
|
||||
});
|
||||
};
|
||||
|
||||
configDir = mkOption {
|
||||
type = types.path;
|
||||
type = path;
|
||||
default = "/var/lib/radius/raddb";
|
||||
description = "The path of the freeradius server configuration directory.";
|
||||
};
|
||||
|
||||
authTokenFile = mkOption {
|
||||
type = types.path;
|
||||
type = path;
|
||||
description = "File to the auth token for the service account.";
|
||||
};
|
||||
|
||||
extra-mods = mkOption {
|
||||
type = types.attrsOf types.path;
|
||||
type = attrsOf path;
|
||||
default = { };
|
||||
description = "Additional files to be linked in mods-enabled.";
|
||||
};
|
||||
|
||||
extra-sites = mkOption {
|
||||
type = types.attrsOf types.path;
|
||||
type = attrsOf path;
|
||||
default = { };
|
||||
description = "Additional files to be linked in sites-enabled.";
|
||||
};
|
||||
|
||||
dictionary = mkOption {
|
||||
type = types.attrsOf (
|
||||
types.enum [
|
||||
type = attrsOf (enum [
|
||||
"abinary"
|
||||
"date"
|
||||
"ipaddr"
|
||||
"integer"
|
||||
"string"
|
||||
]
|
||||
);
|
||||
]);
|
||||
default = { };
|
||||
description = "Declare additionnal attributes to be listed in the dictionary.";
|
||||
};
|
||||
|
||||
radiusClients = mkOption {
|
||||
type = types.attrsOf (
|
||||
types.submodule {
|
||||
type = attrsOf (submodule {
|
||||
options = {
|
||||
secret = mkOption { type = types.path; };
|
||||
ipaddr = mkOption { type = types.str; };
|
||||
secret = mkOption { type = path; };
|
||||
ipaddr = mkOption { type = str; };
|
||||
};
|
||||
}
|
||||
);
|
||||
});
|
||||
default = { };
|
||||
description = "A mapping of clients and their authentication tokens.";
|
||||
};
|
||||
|
||||
certs = {
|
||||
ca = mkOption {
|
||||
type = types.str;
|
||||
description = "The signing CA of the RADIUS certificate.";
|
||||
};
|
||||
dh = mkOption {
|
||||
type = types.str;
|
||||
description = "The output of `openssl dhparam -in ca.pem -out dh.pem 2048`.";
|
||||
};
|
||||
cert = mkOption {
|
||||
type = types.str;
|
||||
description = "The certificate for the RADIUS server.";
|
||||
};
|
||||
key = mkOption {
|
||||
type = types.str;
|
||||
description = "The signing key for the RADIUS certificate.";
|
||||
};
|
||||
};
|
||||
|
||||
privateKeyPasswordFile = mkOption { type = types.path; };
|
||||
|
||||
checkConfiguration = mkOption {
|
||||
type = types.bool;
|
||||
type = bool;
|
||||
description = "Check the configuration before starting the deamon. Useful for debugging.";
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Certificate setup
|
||||
services.nginx.virtualHosts.${cfg.domain} = {
|
||||
http2 = false;
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
};
|
||||
|
||||
users = {
|
||||
users.radius = {
|
||||
group = "radius";
|
||||
|
|
@ -127,49 +131,45 @@ in
|
|||
groups.radius = { };
|
||||
};
|
||||
|
||||
services.k-radius.settings = {
|
||||
ca_path = cfg.certs.ca;
|
||||
|
||||
radius_cert_path = cfg.certs.cert;
|
||||
radius_key_path = cfg.certs.key;
|
||||
radius_dh_path = cfg.certs.dh;
|
||||
radius_ca_path = cfg.certs.ca;
|
||||
};
|
||||
|
||||
systemd.services.radius = {
|
||||
description = "FreeRadius server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
after = [
|
||||
"network.target"
|
||||
"acme-finished-${cfg.domain}.target"
|
||||
];
|
||||
wants = [ "network.target" ];
|
||||
startLimitIntervalSec = 20;
|
||||
startLimitBurst = 5;
|
||||
|
||||
preStart = ''
|
||||
rm -rf ${cfg.configDir}
|
||||
mkdir -p ${cfg.configDir}
|
||||
raddb=${cfg.raddb}
|
||||
|
||||
cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* ${cfg.configDir}
|
||||
cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* ${cfg.configDir}
|
||||
# Recreate the configuration directory
|
||||
rm -rf $raddb && mkdir -p $raddb
|
||||
|
||||
chmod -R u+w ${cfg.configDir}
|
||||
cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* $raddb
|
||||
cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* $raddb
|
||||
|
||||
chmod -R u+w $raddb
|
||||
|
||||
# disable auth via methods kanidm doesn't support
|
||||
rm ${cfg.configDir}/mods-available/sql
|
||||
rm ${cfg.configDir}/mods-enabled/{passwd,totp}
|
||||
rm $raddb/mods-available/sql
|
||||
rm $raddb/mods-enabled/{passwd,totp}
|
||||
|
||||
# enable the python and cache modules
|
||||
ln -nsf ${cfg.configDir}/mods-available/python3 ${cfg.configDir}/mods-enabled/python3
|
||||
ln -nsf ${cfg.configDir}/sites-available/check-eap-tls ${cfg.configDir}/sites-enabled/check-eap-tls
|
||||
ln -nsf $raddb/mods-available/python3 $raddb/mods-enabled/python3
|
||||
ln -nsf $raddb/sites-available/check-eap-tls $raddb/sites-enabled/check-eap-tls
|
||||
|
||||
# write the clients configuration
|
||||
rm ${cfg.configDir}/clients.conf && touch ${cfg.configDir}/clients.conf
|
||||
> $raddb/clients.conf
|
||||
${builtins.concatStringsSep "\n" (
|
||||
builtins.attrValues (
|
||||
builtins.mapAttrs (
|
||||
name:
|
||||
{ secret, ipaddr }:
|
||||
''
|
||||
cat <<EOF >> ${cfg.configDir}/clients.conf
|
||||
cat <<EOF >> $raddb/clients.conf
|
||||
client ${name} {
|
||||
ipaddr = ${ipaddr}
|
||||
secret = $(cat "${secret}")
|
||||
|
|
@ -190,19 +190,16 @@ in
|
|||
chmod u+w /var/lib/radius/kanidm.toml
|
||||
|
||||
# Copy the certificates to the correct directory
|
||||
rm -rf ${cfg.configDir}/certs && mkdir -p ${cfg.configDir}/certs
|
||||
rm -rf $raddb/certs && mkdir -p $raddb/certs
|
||||
|
||||
cp ${cfg.certs.ca} ${cfg.configDir}/certs/ca.pem
|
||||
cp ${acmeDirectory}/chain.pem $raddb/certs/ca.pem
|
||||
|
||||
${pkgs.openssl}/bin/openssl rehash ${cfg.configDir}/certs
|
||||
${lib.getExe pkgs.openssl} rehash $raddb/certs
|
||||
|
||||
cp ${cfg.certs.dh} ${cfg.configDir}/certs/dh.pem
|
||||
# Recreate the dh.pem file
|
||||
${lib.getExe pkgs.openssl} dhparam -in $raddb/certs/ca.pem -out $raddb/certs/dh.pem 2048
|
||||
|
||||
cat ${cfg.certs.cert} ${cfg.certs.key} > ${cfg.configDir}/certs/server.pem
|
||||
|
||||
# Write the password of the private_key in the eap module
|
||||
sed -i ${cfg.configDir}/mods-available/eap \
|
||||
-e "s/whatever/$(cat "${cfg.privateKeyPasswordFile}")/"
|
||||
cp ${acmeDirectory}/full.pem $raddb/certs/server.pem
|
||||
|
||||
# Link the dictionary
|
||||
ln -nsf ${
|
||||
|
|
@ -213,22 +210,20 @@ in
|
|||
)
|
||||
)
|
||||
)
|
||||
} ${cfg.configDir}/dictionary
|
||||
} $raddb/dictionary
|
||||
|
||||
# Link extra-mods
|
||||
${builtins.concatStringsSep "\n" (
|
||||
mapAttrsToList (name: path: "ln -nsf ${path} ${cfg.configDir}/mods-enabled/${name}") cfg.extra-mods
|
||||
mapAttrsToList (name: path: "ln -nsf ${path} $raddb/mods-enabled/${name}") cfg.extra-mods
|
||||
)}
|
||||
|
||||
# Link extra-sites
|
||||
${builtins.concatStringsSep "\n" (
|
||||
mapAttrsToList (
|
||||
name: path: "ln -nsf ${path} ${cfg.configDir}/sites-enabled/${name}"
|
||||
) cfg.extra-sites
|
||||
mapAttrsToList (name: path: "ln -nsf ${path} $raddb/sites-enabled/${name}") cfg.extra-sites
|
||||
)}
|
||||
|
||||
# Check the configuration
|
||||
${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d ${cfg.configDir} -l stdout"}
|
||||
${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d $raddb -l stdout"}
|
||||
'';
|
||||
|
||||
path = [
|
||||
|
|
@ -236,25 +231,28 @@ in
|
|||
pkgs.gnused
|
||||
];
|
||||
|
||||
environment = {
|
||||
KANIDM_RLM_CONFIG = "/var/lib/radius/kanidm.toml";
|
||||
PYTHONPATH = rlm_python.pythonPath;
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d ${cfg.configDir} -l stdout";
|
||||
ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d /var/lib/radius/raddb -l stdout";
|
||||
ExecReload = [
|
||||
"${cfg.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout"
|
||||
"${cfg.freeradius}/bin/radiusd -C -d /var/lib/radius/raddb -l stdout"
|
||||
"${pkgs.coreutils}/bin/kill -HUP $MAINPID"
|
||||
];
|
||||
User = "radius";
|
||||
Group = "radius";
|
||||
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
|
||||
DynamicUser = true;
|
||||
Group = "radius";
|
||||
LogsDirectory = "radius";
|
||||
ReadOnlyPaths = [ acmeDirectory ];
|
||||
Restart = "on-failure";
|
||||
RestartSec = 2;
|
||||
LogsDirectory = "radius";
|
||||
StateDirectory = "radius";
|
||||
RuntimeDirectory = "radius";
|
||||
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
|
||||
Environment = [
|
||||
"KANIDM_RLM_CONFIG=/var/lib/radius/kanidm.toml"
|
||||
"PYTHONPATH=${rlm_python.pythonPath}"
|
||||
];
|
||||
StateDirectory = "radius";
|
||||
SupplementaryGroups = [ "nginx" ];
|
||||
User = "radius";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
Loading…
Reference in a new issue