Commit Graph

11 Commits

Author SHA1 Message Date
oaksoaj
fc9e22fca1 yggdrasil: add group option back and remove systemd User= directive
The group configuration parameter allow to share access to yggdrasil
control socket with the users in the system. In the version we propose,
it is null by default so that only root can access the control socket,
but let user create their own group if they need.

Remove User= durective in systemd unit. Should a user with the specified
name already exist in the system, it would be used silently instead of a
dynamic user which could be a security concern.
2022-07-18 12:56:59 -05:00
oaksoaj
080774e28f yggdrasil: reenable DynamicUser
Since version 0.4 Yggdrasil works again using systemd's DynamicUser option.
This patch reenables it to improve security.

We tested this with both persistent and non-persistent keys. Everything
seems to work fine.
2022-07-18 12:56:59 -05:00
Naïm Favier
2ddc335e6f
nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
Gemini Lasswell
28f51d7757 nixos/yggdrasil: set directory permissions before writing keys
Remove the opportunity for someone to read the keys in between when
they are written and when the chmod is done.  Addresses #121293.
2021-05-08 09:49:19 +02:00
Emery Hemingway
764a9252a3 nixos/yggdrasil: add manual section 2020-07-25 16:34:20 +02:00
Emery Hemingway
ac97b19a2a nixos/yggdrasil: change config priority, persistentKeys
Favor the configuration in "configFile" over "config" to allow
"configFile" to override "config" without a system rebuild.

Add a "persistentKeys" option to generate keys and addresses that
persist across service restarts. This is useful for self-configuring
boot media.
2020-05-21 12:11:13 +05:30
Emery Hemingway
0d49162aa0 nixos/yggdrasil: add group option
Allow users to access the Yggdrasil control socket by group.
2020-05-02 01:21:55 +05:30
Emery Hemingway
6c1c99d6b4 nixos/yggdrasil: fix for configFile option
The configFile was not being merged with the declarative configuration at
runtime.
2019-12-07 19:56:49 +01:00
Emery Hemingway
7a1b4d1964 nixos/yggdrasil: remove /etc effects
Use of the /etc directory should be avoided for software without
hardcoded configuration paths.
2019-11-16 16:36:17 +01:00
Gemini Lasswell
d6549a2c42 nixos/yggdrasil: remove DynamicUser for systemd 243 2019-10-26 13:51:31 +02:00
Gemini Lasswell
b8cb8c39d6 nixos/yggdrasil: add service 2019-10-26 13:51:31 +02:00