nixos/frp: init

This commit is contained in:
zaldnoay 2023-09-13 00:13:15 +08:00 committed by Lin Jian
parent 948e875475
commit 6cd38e43cd
3 changed files with 96 additions and 0 deletions

View file

@ -16,6 +16,8 @@
- [acme-dns](https://github.com/joohoi/acme-dns), a limited DNS server to handle ACME DNS challenges easily and securely. Available as [services.acme-dns](#opt-services.acme-dns.enable).
- [frp](https://github.com/fatedier/frp), a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet. Available as [services.frp](#opt-services.frp.enable).
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- [river](https://github.com/riverwm/river), A dynamic tiling wayland compositor. Available as [programs.river](#opt-programs.river.enable).

View file

@ -899,6 +899,7 @@
./services/networking/flannel.nix
./services/networking/freenet.nix
./services/networking/freeradius.nix
./services/networking/frp.nix
./services/networking/frr.nix
./services/networking/gateone.nix
./services/networking/gdomap.nix

View file

@ -0,0 +1,93 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.frp;
settingsFormat = pkgs.formats.ini { };
configFile = settingsFormat.generate "frp.ini" cfg.settings;
isClient = (cfg.role == "client");
isServer = (cfg.role == "server");
in
{
options = {
services.frp = {
enable = mkEnableOption (mdDoc "frp");
package = mkPackageOptionMD pkgs "frp" { };
role = mkOption {
type = types.enum [ "server" "client" ];
description = mdDoc ''
The frp consists of `client` and `server`. The server is usually
deployed on the machine with a public IP address, and
the client is usually deployed on the machine
where the Intranet service to be penetrated resides.
'';
};
settings = mkOption {
type = settingsFormat.type;
default = { };
description = mdDoc ''
Frp configuration, for configuration options
see the example of [client](https://github.com/fatedier/frp/blob/dev/conf/frpc_full.ini)
or [server](https://github.com/fatedier/frp/blob/dev/conf/frps_full.ini) on github.
'';
example = literalExpression ''
{
common = {
server_addr = "x.x.x.x";
server_port = 7000;
};
}
'';
};
};
};
config =
let
serviceCapability = optionals isServer [ "CAP_NET_BIND_SERVICE" ];
executableFile = if isClient then "frpc" else "frps";
in
mkIf cfg.enable {
systemd.services = {
frp = {
wants = optionals isClient [ "network-online.target" ];
after = if isClient then [ "network-online.target" ] else [ "network.target" ];
wantedBy = [ "multi-user.target" ];
description = "A fast reverse proxy frp ${cfg.role}";
serviceConfig = {
Type = "simple";
Restart = "on-failure";
RestartSec = 15;
ExecStart = "${cfg.package}/bin/${executableFile} -c ${configFile}";
StateDirectoryMode = optionalString isServer "0700";
DynamicUser = true;
# Hardening
UMask = optionalString isServer "0007";
CapabilityBoundingSet = serviceCapability;
AmbientCapabilities = serviceCapability;
PrivateDevices = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ] ++ optionals isClient [ "AF_UNIX" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
PrivateMounts = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" ];
};
};
};
};
meta.maintainers = with maintainers; [ zaldnoay ];
}