mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden Heather: retire remote agents and proxy, disable Jupyter, sandbox Matrix admin

Browse source
This commit is contained in:
heather 2026-10-25 22:56:01 +00:00
commit 6e2ba02b9a
5 changed files with 53 additions and 149 deletions
Download patch file Download diff file Expand all files Collapse all files

51
hosts/heather/tuwunel-admin.nix
View file

@ -1,20 +1,8 @@
# heather — tuwunel-admin (web admin UI for tuwunel Matrix homeserver).
#
# https://github.com/knadh/tuwunel-admin (Rust, axum, self-contained static binary).
# Логинится matrix-пользователем на homeserver https://iscg.dev (см. [matrix]
# в config.toml). Чтобы UI мог выполнять admin-команды, залогиненный юзер
# должен быть server admin tuwunel (первый зарегистрированный = admin room member).
#
# Слушает 127.0.0.1:8009 → Caddy admin.iscg.dev терминирует TLS (см. caddy.nix).
# Конфиг: /var/lib/tuwunel-admin/config.toml (вне git, root:root 0644).
#
# Бинарь: публичного docker-образа НЕТ. Это статический x86_64 бинарник v0.0.0
# (скопирован с iscg-dev-jul11 2026-07-13), лежит ВНЕ nix-store:
# /var/lib/tuwunel-admin/tuwunel-admin
# При пересоздании heather с нуля — перескопировать с jul11 или скачать релиз
# https://github.com/knadh/tuwunel-admin/releases (v0.1.0+).
{ config, pkgs, lib, ... }:
# Public Matrix admin UI: a separate unprivileged, sandboxed identity.
# The root-owned binary and non-secret config remain read-only outside Nix.
# StateDirectory is deliberately DIFFERENT from the executable directory:
# systemd must never make the binary/config writable by the service user.
{ ... }:
{
systemd.services.tuwunel-admin = {
description = "tuwunel-admin (Matrix admin web UI)";
@ -23,13 +11,34 @@
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
DynamicUser = true;
User = "tuwunel-admin";
StateDirectory = "tuwunel-admin-state";
StateDirectoryMode = "0700";
WorkingDirectory = "/var/lib/tuwunel-admin-state";
Environment = [ "HOME=/var/lib/tuwunel-admin-state" ];
ExecStart = "/var/lib/tuwunel-admin/tuwunel-admin --config /var/lib/tuwunel-admin/config.toml";
WorkingDirectory = "/var/lib/tuwunel-admin";
Restart = "on-failure";
RestartSec = 5;
# Бинарь статический, рут-запуск ок (биндит 127.0.0.1:8009).
User = "root";
Environment = [ "HOME=/var/lib/tuwunel-admin" ];
UMask = "0077";
NoNewPrivileges = true;
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
PrivateDevices = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
ProtectClock = true;
RestrictSUIDSGID = true;
RestrictNamespaces = true;
LockPersonality = true;
CapabilityBoundingSet = "";
AmbientCapabilities = "";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
MemoryMax = "256M";
TasksMax = 128;
};
};
}