From 66c95642742221d631b69d0befe228eaad00fa9b Mon Sep 17 00:00:00 2001 From: aftix Date: Mon, 13 May 2024 15:50:01 -0500 Subject: [PATCH] Moved znc behind nginx reverse proxy --- host/fermi.nix | 3 +- host/opt/openssh.nix | 1 + host/opt/www/default.nix | 1 + host/opt/www/znc.nix | 272 +++++++++++++++++++++++++++++++++++++++ host/opt/znc.nix | 252 ------------------------------------ 5 files changed, 276 insertions(+), 253 deletions(-) create mode 100644 host/opt/www/znc.nix delete mode 100644 host/opt/znc.nix diff --git a/host/fermi.nix b/host/fermi.nix index 223ac7c..4b120a8 100644 --- a/host/fermi.nix +++ b/host/fermi.nix @@ -10,7 +10,6 @@ in { ./opt/docker.nix ./opt/openssh.nix ./opt/www - ./opt/znc.nix ]; sops = { @@ -29,6 +28,8 @@ in { blog = true; searx.enable = true; }; + + znc.enable = true; }; security.sudo.extraRules = [ diff --git a/host/opt/openssh.nix b/host/opt/openssh.nix index 6d42e3e..edcb1d2 100644 --- a/host/opt/openssh.nix +++ b/host/opt/openssh.nix @@ -9,6 +9,7 @@ in { options.my.authorized_keys = mkOption { default = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKGwAhIYy+i9+9cJJUvQKLxxaBFZLMflqKU/5L+uiRs aftix@aftix.xyz" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDdA7USr9YDNU319SsiuCthpmpq0xvLYPWxDnXG3wsbyrBmBn4RWwH5Ard5KPG9LqxEbOVpn8x7u0PDR1YaZXvfZ8iuK5CyMvWHZf2SLsTOuJF9qldt8ROmyGqF9+g9zZLnKccI8zLOP/cyf1Go7w4dwa4AxKu0ldT1zQWV/Msrx01eJEo0vaRJSbn6SpgczhQJE1M7e+eaJa1dkC8losTPYPl7eXzcMLMcpejIEYjY35eQPH0qw+/9yOjCABCUXew2PpOrx03/57x/rp7UHkIVLj0ZW4gKBV6/kSezBl+pB7HjFViU0y2/XofPu7oP2oz1XIXfMDmX7F9eFjpC7hddMQljnvBCtteeSjpWyhNi+9aJ6jayKJxLZIbuTGPyDksAFEpZmUIQ6Q4B9fUFrPoPAwt2UkQHXmKzH0ap6grLkJctXcADr+swPjZy2QA/1Df4ISj1ryBdwBSgY0wqAg4Sa9r/OUgmIsrFsZ/2LBtsdAHHJqG5OHtdOG2chgSDOxM= aftix@neptune" ]; }; diff --git a/host/opt/www/default.nix b/host/opt/www/default.nix index f084cc8..d974162 100644 --- a/host/opt/www/default.nix +++ b/host/opt/www/default.nix @@ -10,6 +10,7 @@ in { imports = [ ./blog.nix ./searx.nix + ./znc.nix ]; options.my.www = { diff --git a/host/opt/www/znc.nix b/host/opt/www/znc.nix new file mode 100644 index 0000000..48ea154 --- /dev/null +++ b/host/opt/www/znc.nix @@ -0,0 +1,272 @@ +{ + pkgs, + config, + lib, + ... +}: let + inherit (lib.options) mkOption mkEnableOption; + inherit (lib.strings) escapeShellArg; + cfg = config.services.znc; + hostname = config.my.www.hostname; + subdomain = config.my.znc.subdomain; +in { + options.my.znc = { + enable = mkEnableOption "znc"; + subdomain = mkOption { + default = "irc"; + type = lib.types.str; + }; + }; + + config = { + sops.secrets = { + znc_password = { + inherit (cfg) group; + owner = cfg.user; + }; + znc_passwordsalt = { + inherit (cfg) group; + owner = cfg.user; + }; + znc_twitchoauth = { + inherit (cfg) group; + owner = cfg.user; + }; + }; + + systemd = { + services = { + znc-init = { + description = "Initialize znc settings"; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + User = cfg.user; + Group = cfg.group; + RuntimeDirectory = cfg.dataDir; + RuntimeDirectoryMode = "750"; + NoNewPrivileges = true; + ProtectSystem = "strict"; + ReadWritePaths = cfg.dataDir; + ProtectHome = true; + StateDirectory = cfg.dataDir; + StateDirectoryMode = "755"; + PrivateTmp = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + RemoveIPC = true; + PrivateNetwork = true; + }; + script = let + passwordSecretPath = escapeShellArg config.sops.secrets.znc_password.path; + passwordSaltSecretPath = escapeShellArg config.sops.secrets.znc_passwordsalt.path; + twitchOauthSecretPath = escapeShellArg config.sops.secrets.znc_twitchoauth.path; + in '' + cd ${cfg.dataDir}/configs || exit 1 + [[ -f ${passwordSecretPath} ]] || exit 1 + [[ -f ${passwordSaltSecretPath} ]] || exit 1 + [[ -f ${twitchOauthSecretPath} ]] || exit 1 + ${pkgs.gnused}/bin/sed -i"" -e "s/PASSWORD/$(cat ${passwordSecretPath})/g" znc.conf + ${pkgs.gnused}/bin/sed -i"" -e "s/PASSWORD/$(cat ${passwordSaltSecretPath})/g" znc.conf + ${pkgs.gnused}/bin/sed -i"" -e "s/PASSWORD/$(cat ${twitchOauthSecretPath})/g" znc.conf + ''; + }; + + znc = { + requires = ["znc-init.service"]; + after = ["znc-init.service"]; + }; + }; + }; + + services = { + nginx = { + virtualHosts."${subdomain}.${hostname}" = { + serverName = "${subdomain}.${hostname} www.${subdomain}.${hostname}"; + kTLS = true; + forceSSL = true; + useACMEHost = hostname; + + locations = + { + "/" = { + proxyPass = "http://[[::1]]:7001/"; + extraConfig = '' + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; + }; + } + // config.my.www.acme-location-block; + }; + + streamConfig = '' + upstream znc { + server [::1]::7000; + } + + server { + listen 0.0.0.0:6697 http2 ssl; + listen [::0]:6697 http2 ssl; + + ssl_certificate ${config.security.acme.certs.${hostname}.directory}/fullchain.pem; + ssl_certificate_key ${config.security.acme.certs.${hostname}.directory}/key.pem; + ssl_trusted_certificate ${config.security.acme.certs.${hostname}.directory}/chain.pem; + ssl_conf_command Options KTLS; + + proxy_pass znc; + } + ''; + }; + + znc = { + inherit (config.my.www) user group; + enable = true; + mutable = false; + modulePackages = with pkgs.zncModules; [ + clientbuffer + ]; + + useLegacyConfig = false; + config = { + AnonIPLimit = 10; + AuthOnlyViaModule = false; + ConfigWriteDelay = 0; + ConnectDelay = 5; + HideVersion = false; + MaxBufferSize = 500; + ProtectWebSessions = true; + ServerThrottle = 30; + LoadModule = [ + "webadmin" + "certauth" + ]; + + TrustedProxy = [ + "127.0.0.1" + "::1" + ]; + + Listener = { + listener0 = { + AllowIRC = true; + AllowWeb = false; + IPv4 = false; + IPv6 = true; + Port = 7000; + URIPrefix = "/"; + }; + + listener1 = { + AllowIRC = false; + AllowWeb = true; + IPv4 = false; + IPv6 = true; + Port = 7001; + URIPrefix = "/"; + }; + }; + + User.aftix = { + AltNick = "aftix_"; + Ident = "aftix"; + Nick = "aftix"; + RealName = "aftix"; + + Admin = true; + AppendTimestamp = false; + AuthOnlyViaModule = false; + AutoClearChanBuffer = false; + AutoClearQueryBuffer = false; + ChanBufferSize = 50; + DenyLoadMod = false; + DenySetBindHost = false; + JoinTries = 10; + MaxJoins = 0; + MaxNetworks = 1; + LoadModul = [ + "chansaver" + "controlpanel" + "dcc" + "webadmin" + ]; + + MaxQueryBuffers = 50; + MultiClients = true; + NoTrafficTimeout = 180; + PrependTimestamp = true; + QueryBufferSize = 50; + QuitMsg = "%znc%"; + StatusPrefix = "*"; + TimestampFormat = "[%H:%M:%S]"; + + Network = let + network = { + LoadModule = [ + "cert" + "sasl" + "simple_away" + "keepnick" + "savebuff" + "clientbuffer" + "autoadd" + "route_replies" + ]; + FloodBurst = 9; + FloodRate = "2.00"; + IRCConnectEnabled = true; + JoinDelay = 0; + TrustAllCerts = false; + TrustPKI = true; + }; + in { + oftc = + { + Server = "irc.oftc.net + 6697"; + } + // network; + + esper = + { + Server = "irc.esper.net +6697"; + Chan."#squirrels" = {}; + } + // network; + + libera = + { + Server = "irc.libera.chat +6697"; + } + // network; + + snoonet = + { + Server = "irc.snoonet.org 6667"; + } + // network; + + twitch = + { + Server = "irc.chat.twitch.tv 6667 TWITCHOAUTH"; + } + // network; + }; + + Pass.password = { + Hash = "PASSWORD"; + Method = "SHA256"; + Salt = "PASSWORDSALT"; + }; + }; + }; + }; + }; + }; +} diff --git a/host/opt/znc.nix b/host/opt/znc.nix deleted file mode 100644 index b159a09..0000000 --- a/host/opt/znc.nix +++ /dev/null @@ -1,252 +0,0 @@ -{ - pkgs, - config, - lib, - ... -}: let - inherit (lib.options) mkOption; - inherit (lib.strings) escapeShellArg; - cfg = config.services.znc; -in { - options.my.znc.hostname = mkOption { - default = "aftix.xyz"; - type = lib.types.str; - }; - - config = { - networking.firewall = { - allowedTCPPorts = [6697]; - allowedUDPPorts = [6697]; - }; - - sops.secrets = { - znc_password = { - inherit (cfg) group; - owner = cfg.user; - }; - znc_passwordsalt = { - inherit (cfg) group; - owner = cfg.user; - }; - znc_twitchoauth = { - inherit (cfg) group; - owner = cfg.user; - }; - }; - - systemd = { - services = { - znc-init-keys = { - description = "Initialize znc certificates"; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - WorkingDirectory = cfg.dataDir; - NoNewPrivileges = true; - ProtectSystem = "strict"; - ReadWritePaths = cfg.dataDir; - ProtectHome = true; - StateDirectory = cfg.dataDir; - StateDirectoryMode = "755"; - PrivateTmp = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - RemoveIPC = true; - PrivateNetwork = true; - }; - script = let - keysDir = escapeShellArg config.security.acme.certs.${config.my.znc.hostname}.directory; - in '' - cat ${keysDir}/privkey.pem ${keysDir}/fullchain.pem > ${escapeShellArg cfg.dataDir}/znc.pem - chown -R ${cfg.user}:${cfg.group} ${escapeShellArg cfg.dataDir} - chmod 0600 ${escapeShellArg cfg.dataDir}/znc.pem - ''; - }; - znc-init = { - description = "Initialize znc settings"; - requires = ["znc-init-keys.service"]; - after = ["znc-init-keys.service"]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - User = cfg.user; - Group = cfg.group; - RuntimeDirectory = cfg.dataDir; - RuntimeDirectoryMode = "750"; - NoNewPrivileges = true; - ProtectSystem = "strict"; - ReadWritePaths = cfg.dataDir; - ProtectHome = true; - StateDirectory = cfg.dataDir; - StateDirectoryMode = "755"; - PrivateTmp = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - RemoveIPC = true; - PrivateNetwork = true; - }; - script = let - passwordSecretPath = escapeShellArg config.sops.secrets.znc_password.path; - passwordSaltSecretPath = escapeShellArg config.sops.secrets.znc_passwordsalt.path; - twitchOauthSecretPath = escapeShellArg config.sops.secrets.znc_twitchoauth.path; - in '' - cd ${cfg.dataDir}/configs || exit 1 - [[ -f ${passwordSecretPath} ]] || exit 1 - [[ -f ${passwordSaltSecretPath} ]] || exit 1 - [[ -f ${twitchOauthSecretPath} ]] || exit 1 - ${pkgs.gnused}/bin/sed -i"" -e "s/PASSWORD/$(cat ${passwordSecretPath})/g" znc.conf - ${pkgs.gnused}/bin/sed -i"" -e "s/PASSWORD/$(cat ${passwordSaltSecretPath})/g" znc.conf - ${pkgs.gnused}/bin/sed -i"" -e "s/PASSWORD/$(cat ${twitchOauthSecretPath})/g" znc.conf - ''; - }; - - znc = { - requires = ["znc-init.service"]; - after = ["znc-init.service"]; - }; - }; - }; - - services.znc = { - enable = true; - modulePackages = with pkgs.zncModules; [ - clientbuffer - ]; - - useLegacyConfig = false; - config = rec { - AnonIPLimit = 10; - AuthOnlyViaModule = false; - ConfigWriteDelay = 0; - ConnectDelay = 5; - HideVersion = false; - MaxBufferSize = 500; - ProtectWebSessions = true; - SSLCertFile = "${cfg.dataDir}/znc.pem"; - SSLDHParamFile = SSLCertFile; - SSLKeyFile = SSLCertFile; - ServerThrottle = 30; - LoadModule = [ - "webadmin" - "certauth" - ]; - - Listener.listener0 = { - AllowIRC = true; - AllowWeb = true; - IPv4 = true; - IPv6 = true; - Port = 6697; - SSL = true; - URIPrefix = "/"; - }; - - User.aftix = { - AltNick = "aftix_"; - Ident = "aftix"; - Nick = "aftix"; - RealName = "aftix"; - - Admin = true; - AppendTimestamp = false; - AuthOnlyViaModule = false; - AutoClearChanBuffer = false; - AutoClearQueryBuffer = false; - ChanBufferSize = 50; - DenyLoadMod = false; - DenySetBindHost = false; - JoinTries = 10; - MaxJoins = 0; - MaxNetworks = 1; - LoadModul = [ - "chansaver" - "controlpanel" - "dcc" - "webadmin" - ]; - - MaxQueryBuffers = 50; - MultiClients = true; - NoTrafficTimeout = 180; - PrependTimestamp = true; - QueryBufferSize = 50; - QuitMsg = "%znc%"; - StatusPrefix = "*"; - TimestampFormat = "[%H:%M:%S]"; - - Network = let - network = { - LoadModule = [ - "cert" - "sasl" - "simple_away" - "keepnick" - "savebuff" - "clientbuffer" - "autoadd" - "route_replies" - ]; - FloodBurst = 9; - FloodRate = "2.00"; - IRCConnectEnabled = true; - JoinDelay = 0; - TrustAllCerts = false; - TrustPKI = true; - }; - in { - oftc = - { - Server = "irc.oftc.net + 6697"; - } - // network; - - esper = - { - Server = "irc.esper.net +6697"; - Chan."#squirrels" = {}; - } - // network; - - libera = - { - Server = "irc.libera.chat +6697"; - } - // network; - - snoonet = - { - Server = "irc.snoonet.org 6667"; - } - // network; - - twitch = - { - Server = "irc.chat.twitch.tv 6667 TWITCHOAUTH"; - } - // network; - }; - - Pass.password = { - Hash = "PASSWORD"; - Method = "SHA256"; - Salt = "PASSWORDSALT"; - }; - }; - }; - }; - }; -}