lbailly/infrastructure
1
0
Fork 0
forked from DGNum/infrastructure
Code Pull requests Activity

feat(k-radius): Use LE certificates instead of self-signed ones

Browse source
This commit is contained in:
Tom Hubrecht 2024-09-01 15:40:59 +02:00
parent 3ca3ff8939
commit 8a42e18d98
Signed by: thubrecht
SSH key fingerprint: SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
3 changed files with 95 additions and 103 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
machines/vault01/_configuration.nix
View file

@ -20,6 +20,8 @@ lib.extra.mkConfig {
]; ];
services.netbird.enable = true; services.netbird.enable = true;
services.nginx.enable = true;
networking.firewall.allowedTCPPorts = [ 80 ];
}; };
root = ./.; root = ./.;

14
machines/vault01/k-radius/default.nix
View file

@ -1,4 +1,4 @@
{ config, lib, ... }: { config, ... }:
{ {
imports = [ ./module.nix ]; imports = [ ./module.nix ];
@ -6,6 +6,8 @@
services.k-radius = { services.k-radius = {
enable = true; enable = true;
domain = "radius.dgnum.eu";
radiusClients = { radiusClients = {
ap = { ap = {
ipaddr = "0.0.0.0/0"; ipaddr = "0.0.0.0/0";
@ -47,16 +49,6 @@
}; };
authTokenFile = config.age.secrets."radius-auth_token_file".path; authTokenFile = config.age.secrets."radius-auth_token_file".path;
privateKeyPasswordFile = config.age.secrets."radius-private_key_password_file".path;
certs = builtins.listToAttrs (
builtins.map (name: lib.nameValuePair name config.age.secrets."radius-${name}_pem_file".path) [
"ca"
"cert"
"dh"
"key"
]
);
}; };
age-secrets.autoMatch = [ "radius" ]; age-secrets.autoMatch = [ "radius" ];

168
machines/vault01/k-radius/module.nix
View file

@ -15,7 +15,16 @@ let
mkIf mkIf
mkOption mkOption
optionalString optionalString
types ;
inherit (lib.types)
attrsOf
bool
enum
package
path
str
submodule
; ;
settingsFormat = pkgs.formats.toml { }; settingsFormat = pkgs.formats.toml { };
@ -24,99 +33,94 @@ let
rlm_python = pkgs.callPackage ./packages/rlm_python.nix { inherit pykanidm; }; rlm_python = pkgs.callPackage ./packages/rlm_python.nix { inherit pykanidm; };
cfg = config.services.k-radius; cfg = config.services.k-radius;
acmeDirectory = config.security.acme.certs.${cfg.domain}.directory;
in in
{ {
options.services.k-radius = { options.services.k-radius = {
enable = mkEnableOption "a freeradius service linked to kanidm."; enable = mkEnableOption "a freeradius service linked to kanidm.";
domain = mkOption {
type = str;
description = "The domain used for the RADIUS server.";
};
raddb = mkOption {
type = path;
default = "/var/lib/radius/raddb/";
description = "The location of the raddb directory.";
};
settings = mkOption { inherit (settingsFormat) type; }; settings = mkOption { inherit (settingsFormat) type; };
freeradius = mkOption { freeradius = mkOption {
type = types.package; type = package;
default = pkgs.freeradius.overrideAttrs (old: { default = pkgs.freeradius.overrideAttrs (old: {
buildInputs = (old.buildInputs or [ ]) ++ [ (pkgs.python3.withPackages (ps: [ ps.kanidm ])) ]; buildInputs = (old.buildInputs or [ ]) ++ [ (pkgs.python3.withPackages (ps: [ ps.kanidm ])) ];
}); });
}; };
configDir = mkOption { configDir = mkOption {
type = types.path; type = path;
default = "/var/lib/radius/raddb"; default = "/var/lib/radius/raddb";
description = "The path of the freeradius server configuration directory."; description = "The path of the freeradius server configuration directory.";
}; };
authTokenFile = mkOption { authTokenFile = mkOption {
type = types.path; type = path;
description = "File to the auth token for the service account."; description = "File to the auth token for the service account.";
}; };
extra-mods = mkOption { extra-mods = mkOption {
type = types.attrsOf types.path; type = attrsOf path;
default = { }; default = { };
description = "Additional files to be linked in mods-enabled."; description = "Additional files to be linked in mods-enabled.";
}; };
extra-sites = mkOption { extra-sites = mkOption {
type = types.attrsOf types.path; type = attrsOf path;
default = { }; default = { };
description = "Additional files to be linked in sites-enabled."; description = "Additional files to be linked in sites-enabled.";
}; };
dictionary = mkOption { dictionary = mkOption {
type = types.attrsOf ( type = attrsOf (enum [
types.enum [
"abinary" "abinary"
"date" "date"
"ipaddr" "ipaddr"
"integer" "integer"
"string" "string"
] ]);
);
default = { }; default = { };
description = "Declare additionnal attributes to be listed in the dictionary."; description = "Declare additionnal attributes to be listed in the dictionary.";
}; };
radiusClients = mkOption { radiusClients = mkOption {
type = types.attrsOf ( type = attrsOf (submodule {
types.submodule {
options = { options = {
secret = mkOption { type = types.path; }; secret = mkOption { type = path; };
ipaddr = mkOption { type = types.str; }; ipaddr = mkOption { type = str; };
}; };
} });
);
default = { }; default = { };
description = "A mapping of clients and their authentication tokens."; description = "A mapping of clients and their authentication tokens.";
}; };
certs = {
ca = mkOption {
type = types.str;
description = "The signing CA of the RADIUS certificate.";
};
dh = mkOption {
type = types.str;
description = "The output of `openssl dhparam -in ca.pem -out dh.pem 2048`.";
};
cert = mkOption {
type = types.str;
description = "The certificate for the RADIUS server.";
};
key = mkOption {
type = types.str;
description = "The signing key for the RADIUS certificate.";
};
};
privateKeyPasswordFile = mkOption { type = types.path; };
checkConfiguration = mkOption { checkConfiguration = mkOption {
type = types.bool; type = bool;
description = "Check the configuration before starting the deamon. Useful for debugging."; description = "Check the configuration before starting the deamon. Useful for debugging.";
default = false; default = false;
}; };
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
# Certificate setup
services.nginx.virtualHosts.${cfg.domain} = {
http2 = false;
enableACME = true;
forceSSL = true;
};
users = { users = {
users.radius = { users.radius = {
group = "radius"; group = "radius";
@ -127,49 +131,45 @@ in
groups.radius = { }; groups.radius = { };
}; };
services.k-radius.settings = {
ca_path = cfg.certs.ca;
radius_cert_path = cfg.certs.cert;
radius_key_path = cfg.certs.key;
radius_dh_path = cfg.certs.dh;
radius_ca_path = cfg.certs.ca;
};
systemd.services.radius = { systemd.services.radius = {
description = "FreeRadius server"; description = "FreeRadius server";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
after = [ "network.target" ]; after = [
"network.target"
"acme-finished-${cfg.domain}.target"
];
wants = [ "network.target" ]; wants = [ "network.target" ];
startLimitIntervalSec = 20; startLimitIntervalSec = 20;
startLimitBurst = 5; startLimitBurst = 5;
preStart = '' preStart = ''
rm -rf ${cfg.configDir} raddb=${cfg.raddb}
mkdir -p ${cfg.configDir}
cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* ${cfg.configDir} # Recreate the configuration directory
cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* ${cfg.configDir} rm -rf $raddb && mkdir -p $raddb
chmod -R u+w ${cfg.configDir} cp -R --no-preserve=mode ${cfg.freeradius}/etc/raddb/* $raddb
cp -R --no-preserve=mode ${rlm_python}/etc/raddb/* $raddb
chmod -R u+w $raddb
# disable auth via methods kanidm doesn't support # disable auth via methods kanidm doesn't support
rm ${cfg.configDir}/mods-available/sql rm $raddb/mods-available/sql
rm ${cfg.configDir}/mods-enabled/{passwd,totp} rm $raddb/mods-enabled/{passwd,totp}
# enable the python and cache modules # enable the python and cache modules
ln -nsf ${cfg.configDir}/mods-available/python3 ${cfg.configDir}/mods-enabled/python3 ln -nsf $raddb/mods-available/python3 $raddb/mods-enabled/python3
ln -nsf ${cfg.configDir}/sites-available/check-eap-tls ${cfg.configDir}/sites-enabled/check-eap-tls ln -nsf $raddb/sites-available/check-eap-tls $raddb/sites-enabled/check-eap-tls
# write the clients configuration # write the clients configuration
rm ${cfg.configDir}/clients.conf && touch ${cfg.configDir}/clients.conf > $raddb/clients.conf
${builtins.concatStringsSep "\n" ( ${builtins.concatStringsSep "\n" (
builtins.attrValues ( builtins.attrValues (
builtins.mapAttrs ( builtins.mapAttrs (
name: name:
{ secret, ipaddr }: { secret, ipaddr }:
'' ''
cat <<EOF >> ${cfg.configDir}/clients.conf cat <<EOF >> $raddb/clients.conf
client ${name} { client ${name} {
ipaddr = ${ipaddr} ipaddr = ${ipaddr}
secret = $(cat "${secret}") secret = $(cat "${secret}")
@ -190,19 +190,16 @@ in
chmod u+w /var/lib/radius/kanidm.toml chmod u+w /var/lib/radius/kanidm.toml
# Copy the certificates to the correct directory # Copy the certificates to the correct directory
rm -rf ${cfg.configDir}/certs && mkdir -p ${cfg.configDir}/certs rm -rf $raddb/certs && mkdir -p $raddb/certs
cp ${cfg.certs.ca} ${cfg.configDir}/certs/ca.pem cp ${acmeDirectory}/chain.pem $raddb/certs/ca.pem
${pkgs.openssl}/bin/openssl rehash ${cfg.configDir}/certs ${lib.getExe pkgs.openssl} rehash $raddb/certs
cp ${cfg.certs.dh} ${cfg.configDir}/certs/dh.pem # Recreate the dh.pem file
${lib.getExe pkgs.openssl} dhparam -in $raddb/certs/ca.pem -out $raddb/certs/dh.pem 2048
cat ${cfg.certs.cert} ${cfg.certs.key} > ${cfg.configDir}/certs/server.pem cp ${acmeDirectory}/full.pem $raddb/certs/server.pem
# Write the password of the private_key in the eap module
sed -i ${cfg.configDir}/mods-available/eap \
-e "s/whatever/$(cat "${cfg.privateKeyPasswordFile}")/"
# Link the dictionary # Link the dictionary
ln -nsf ${ ln -nsf ${
@ -213,22 +210,20 @@ in
) )
) )
) )
} ${cfg.configDir}/dictionary } $raddb/dictionary
# Link extra-mods # Link extra-mods
${builtins.concatStringsSep "\n" ( ${builtins.concatStringsSep "\n" (
mapAttrsToList (name: path: "ln -nsf ${path} ${cfg.configDir}/mods-enabled/${name}") cfg.extra-mods mapAttrsToList (name: path: "ln -nsf ${path} $raddb/mods-enabled/${name}") cfg.extra-mods
)} )}
# Link extra-sites # Link extra-sites
${builtins.concatStringsSep "\n" ( ${builtins.concatStringsSep "\n" (
mapAttrsToList ( mapAttrsToList (name: path: "ln -nsf ${path} $raddb/sites-enabled/${name}") cfg.extra-sites
name: path: "ln -nsf ${path} ${cfg.configDir}/sites-enabled/${name}"
) cfg.extra-sites
)} )}
# Check the configuration # Check the configuration
${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d ${cfg.configDir} -l stdout"} ${optionalString cfg.checkConfiguration "${getExe' pkgs.freeradius "radiusd"} -C -d $raddb -l stdout"}
''; '';
path = [ path = [
@ -236,25 +231,28 @@ in
pkgs.gnused pkgs.gnused
]; ];
environment = {
KANIDM_RLM_CONFIG = "/var/lib/radius/kanidm.toml";
PYTHONPATH = rlm_python.pythonPath;
};
serviceConfig = { serviceConfig = {
ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d ${cfg.configDir} -l stdout"; ExecStart = "${cfg.freeradius}/bin/radiusd -X -f -d /var/lib/radius/raddb -l stdout";
ExecReload = [ ExecReload = [
"${cfg.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout" "${cfg.freeradius}/bin/radiusd -C -d /var/lib/radius/raddb -l stdout"
"${pkgs.coreutils}/bin/kill -HUP $MAINPID" "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
]; ];
User = "radius"; AmbientCapabilities = "CAP_NET_BIND_SERVICE";
Group = "radius";
DynamicUser = true; DynamicUser = true;
Group = "radius";
LogsDirectory = "radius";
ReadOnlyPaths = [ acmeDirectory ];
Restart = "on-failure"; Restart = "on-failure";
RestartSec = 2; RestartSec = 2;
LogsDirectory = "radius";
StateDirectory = "radius";
RuntimeDirectory = "radius"; RuntimeDirectory = "radius";
AmbientCapabilities = "CAP_NET_BIND_SERVICE"; StateDirectory = "radius";
Environment = [ SupplementaryGroups = [ "nginx" ];
"KANIDM_RLM_CONFIG=/var/lib/radius/kanidm.toml" User = "radius";
"PYTHONPATH=${rlm_python.pythonPath}"
];
}; };
}; };
}; };