mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-11-27 09:23:01 +00:00
Merge pull request #112682 from hax404/upterm
This commit is contained in:
commit
3607d087ec
@ -331,6 +331,14 @@
|
|||||||
<link linkend="opt-services.tetrd.enable">services.tetrd</link>.
|
<link linkend="opt-services.tetrd.enable">services.tetrd</link>.
|
||||||
</para>
|
</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
<link xlink:href="https://upterm.dev">uptermd</link>, an
|
||||||
|
open-source solution for sharing terminal sessions instantly
|
||||||
|
over the public internet via secure tunnels. Available at
|
||||||
|
<link linkend="opt-services.uptermd.enable">services.uptermd</link>.
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>
|
<para>
|
||||||
<link xlink:href="https://github.com/mbrubeck/agate">agate</link>,
|
<link xlink:href="https://github.com/mbrubeck/agate">agate</link>,
|
||||||
|
@ -101,6 +101,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||||||
|
|
||||||
- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).
|
- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).
|
||||||
|
|
||||||
|
- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
|
||||||
|
|
||||||
- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable).
|
- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable).
|
||||||
|
|
||||||
- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable).
|
- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable).
|
||||||
|
@ -937,6 +937,7 @@
|
|||||||
./services/networking/unifi.nix
|
./services/networking/unifi.nix
|
||||||
./services/video/unifi-video.nix
|
./services/video/unifi-video.nix
|
||||||
./services/video/rtsp-simple-server.nix
|
./services/video/rtsp-simple-server.nix
|
||||||
|
./services/networking/uptermd.nix
|
||||||
./services/networking/v2ray.nix
|
./services/networking/v2ray.nix
|
||||||
./services/networking/vsftpd.nix
|
./services/networking/vsftpd.nix
|
||||||
./services/networking/wasabibackend.nix
|
./services/networking/wasabibackend.nix
|
||||||
|
106
nixos/modules/services/networking/uptermd.nix
Normal file
106
nixos/modules/services/networking/uptermd.nix
Normal file
@ -0,0 +1,106 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.uptermd;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options = {
|
||||||
|
services.uptermd = {
|
||||||
|
enable = mkEnableOption "uptermd";
|
||||||
|
|
||||||
|
openFirewall = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
Whether to open the firewall for the port in <option>services.uptermd.port</option>.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
port = mkOption {
|
||||||
|
type = types.port;
|
||||||
|
default = 2222;
|
||||||
|
description = ''
|
||||||
|
Port the server will listen on.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
listenAddress = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "[::]";
|
||||||
|
example = "127.0.0.1";
|
||||||
|
description = ''
|
||||||
|
Address the server will listen on.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
hostKey = mkOption {
|
||||||
|
type = types.nullOr types.path;
|
||||||
|
default = null;
|
||||||
|
example = "/run/keys/upterm_host_ed25519_key";
|
||||||
|
description = ''
|
||||||
|
Path to SSH host key. If not defined, an ed25519 keypair is generated automatically.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
extraFlags = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [];
|
||||||
|
example = [ "--debug" ];
|
||||||
|
description = ''
|
||||||
|
Extra flags passed to the uptermd command.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
networking.firewall = mkIf cfg.openFirewall {
|
||||||
|
allowedTCPPorts = [ cfg.port ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.uptermd = {
|
||||||
|
description = "Upterm Daemon";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
after = [ "network.target" ];
|
||||||
|
|
||||||
|
path = [ pkgs.openssh ];
|
||||||
|
|
||||||
|
preStart = mkIf (cfg.hostKey == null) ''
|
||||||
|
if ! [ -f ssh_host_ed25519_key ]; then
|
||||||
|
ssh-keygen \
|
||||||
|
-t ed25519 \
|
||||||
|
-f ssh_host_ed25519_key \
|
||||||
|
-N ""
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
StateDirectory = "uptermd";
|
||||||
|
WorkingDirectory = "/var/lib/uptermd";
|
||||||
|
ExecStart = "${pkgs.upterm}/bin/uptermd --ssh-addr ${cfg.listenAddress}:${toString cfg.port} --private-key ${if cfg.hostKey == null then "ssh_host_ed25519_key" else cfg.hostKey} ${concatStringsSep " " cfg.extraFlags}";
|
||||||
|
|
||||||
|
# Hardening
|
||||||
|
AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
||||||
|
CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
||||||
|
PrivateUsers = cfg.port >= 1024;
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = "@system-service";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
@ -575,6 +575,7 @@ in
|
|||||||
unifi = handleTest ./unifi.nix {};
|
unifi = handleTest ./unifi.nix {};
|
||||||
unit-php = handleTest ./web-servers/unit-php.nix {};
|
unit-php = handleTest ./web-servers/unit-php.nix {};
|
||||||
upnp = handleTest ./upnp.nix {};
|
upnp = handleTest ./upnp.nix {};
|
||||||
|
uptermd = handleTest ./uptermd.nix {};
|
||||||
usbguard = handleTest ./usbguard.nix {};
|
usbguard = handleTest ./usbguard.nix {};
|
||||||
user-activation-scripts = handleTest ./user-activation-scripts.nix {};
|
user-activation-scripts = handleTest ./user-activation-scripts.nix {};
|
||||||
uwsgi = handleTest ./uwsgi.nix {};
|
uwsgi = handleTest ./uwsgi.nix {};
|
||||||
|
62
nixos/tests/uptermd.nix
Normal file
62
nixos/tests/uptermd.nix
Normal file
@ -0,0 +1,62 @@
|
|||||||
|
import ./make-test-python.nix ({ pkgs, ...}:
|
||||||
|
|
||||||
|
let
|
||||||
|
client = {pkgs, ...}:{
|
||||||
|
environment.systemPackages = [ pkgs.upterm ];
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
name = "uptermd";
|
||||||
|
meta = with pkgs.lib.maintainers; {
|
||||||
|
maintainers = [ fleaz ];
|
||||||
|
};
|
||||||
|
|
||||||
|
nodes = {
|
||||||
|
server = {config, ...}: {
|
||||||
|
services.uptermd = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
port = 1337;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
client1 = client;
|
||||||
|
client2 = client;
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
testScript = ''
|
||||||
|
start_all()
|
||||||
|
|
||||||
|
server.wait_for_unit("uptermd.service")
|
||||||
|
server.wait_for_unit("network-online.target")
|
||||||
|
|
||||||
|
# Add SSH hostkeys from the server to both clients
|
||||||
|
# uptermd needs an '@cert-authority entry so we need to modify the known_hosts file
|
||||||
|
client1.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
|
||||||
|
client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
|
||||||
|
client2.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
|
||||||
|
client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
|
||||||
|
|
||||||
|
client1.wait_for_unit("multi-user.target")
|
||||||
|
client1.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
|
||||||
|
client1.wait_until_tty_matches(1, "login: ")
|
||||||
|
client1.send_chars("root\n")
|
||||||
|
client1.wait_until_succeeds("pgrep -u root bash")
|
||||||
|
|
||||||
|
client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
|
||||||
|
client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n")
|
||||||
|
client1.wait_for_file("/tmp/session-details")
|
||||||
|
client1.send_key("q")
|
||||||
|
|
||||||
|
# uptermd can't connect if we don't have a keypair
|
||||||
|
client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
|
||||||
|
|
||||||
|
# Grep the ssh connect command from the output of 'upterm host'
|
||||||
|
ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip()
|
||||||
|
|
||||||
|
# Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
|
||||||
|
output = client2.succeed(ssh_command)
|
||||||
|
|
||||||
|
assert output.strip() == "client1"
|
||||||
|
'';
|
||||||
|
})
|
@ -2,6 +2,7 @@
|
|||||||
, buildGo118Module
|
, buildGo118Module
|
||||||
, fetchFromGitHub
|
, fetchFromGitHub
|
||||||
, installShellFiles
|
, installShellFiles
|
||||||
|
, nixosTests
|
||||||
}:
|
}:
|
||||||
|
|
||||||
buildGo118Module rec {
|
buildGo118Module rec {
|
||||||
@ -29,6 +30,8 @@ buildGo118Module rec {
|
|||||||
|
|
||||||
doCheck = true;
|
doCheck = true;
|
||||||
|
|
||||||
|
passthru.tests = { inherit (nixosTests) uptermd; };
|
||||||
|
|
||||||
__darwinAllowLocalNetworking = true;
|
__darwinAllowLocalNetworking = true;
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
|
Loading…
Reference in New Issue
Block a user