From 4422ecabc32f3d4f7c902b679710d21d8c9459e2 Mon Sep 17 00:00:00 2001 From: emily Date: Wed, 11 Sep 2024 20:22:53 +0200 Subject: [PATCH] ooklaserver: Init module --- config/hosts/seras/configuration.nix | 7 ++ modules/default.nix | 1 + modules/ooklaserver/default.nix | 165 +++++++++++++++++++++++++++ 3 files changed, 173 insertions(+) create mode 100644 modules/ooklaserver/default.nix diff --git a/config/hosts/seras/configuration.nix b/config/hosts/seras/configuration.nix index 423281f..9d4b4af 100644 --- a/config/hosts/seras/configuration.nix +++ b/config/hosts/seras/configuration.nix @@ -20,4 +20,11 @@ "2a0f:be01:0:100::169/128" ]; }; + + kyouma.ooklaserver = { + enable = true; + openFirewall = true; + domain = "speedtest.kyouma.net"; + settings.openSSL.server.minimumTLSProtocol = "1.3"; + }; } diff --git a/modules/default.nix b/modules/default.nix index b207a3b..4884415 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -4,6 +4,7 @@ ./graphical ./machine-type ./nginx + ./ooklaserver ./update-nixfiles ]; } diff --git a/modules/ooklaserver/default.nix b/modules/ooklaserver/default.nix new file mode 100644 index 0000000..6232541 --- /dev/null +++ b/modules/ooklaserver/default.nix @@ -0,0 +1,165 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.kyouma.ooklaserver; +in { + options = { + kyouma.ooklaserver = with lib; { + enable = mkEnableOption "ookla speedtest server"; + package = mkPackageOption pkgs "ooklaserver" {}; + domain = mkOption { + description = "Domain to use."; + default = null; + type = types.str; + }; + openFirewall = mkOption { + description = "Whether to open the firewall for the specified ports."; + default = false; + type = types.bool; + }; + tcpPorts = mkOption { + description = '' + The server listens on TCP port 5060 and 8080 by default. These ports are required for + speedtest.net servers, although more can be added. + ''; + default = [ 5060 8080 ]; + type = with types; listOf port; + }; + udpPorts = mkOption { + description = '' + The server listens on UDP port 5060 and 8080 by default. These ports are required for + speedtest.net servers, although more can be added. + ''; + default = [ 5060 8080 ]; + type = with types; listOf port; + }; + settings = mkOption { + description = '' + OoklaServer configuration written as Nix expression. + Comma seperated values should be written as list. + ''; + default = {}; + type = with lib.types; let + valueType = nullOr (oneOf [ + bool + int + str + (attrsOf valueType) + (listOf (oneOf [ port str ])) + ]); + in valueType; + }; + }; + }; + config = lib.mkIf cfg.enable { + users.users.ooklaserver = { + description = "OoklaServer User"; + group = "ooklaserver"; + createHome = false; + isSystemUser = true; + }; + users.groups.ooklaserver = {}; + security.acme.certs.${cfg.domain} = { + group = "ooklaserver"; + reloadServices = [ "ooklaserver.service" ]; + webroot = "/var/lib/acme/acme-challenge"; + }; + + kyouma.ooklaserver.settings = with lib; { + OoklaServer = { + inherit (cfg) tcpPorts udpPorts; + enableAutoUpdate = false; + ssl.useLetsEncrypt = false; + useIPv6 = mkDefault true; + allowedDomains = mkDefault [ "*.ookla.com" "*.speedtest.net" ]; + userAgentFilterEnabled = mkDefault true; + workerThreadPool = { + capacity = mkDefault 30000; + stackSizeBytes = mkDefault 102400; + }; + ipTracking = { + gcIntervalMinutes = mkDefault 5; + maxIdleAgeMinutes = mkDefault 35; + slidingWindowBucketLengthMinutes = mkDefault 5; + metricTopIpCount = mkDefault 5; + maxConnPerIp = mkDefault 500; + maxConnPerBucketPerIp = mkDefault 20000; + }; + clientAuthToken.denyInvalid = mkDefault true; + websocket.frameSizeLimitBytes = mkDefault 5242880; + http.maxHeadersSize = mkDefault 65536; + }; + openSSL.server = { + certificateFile = "${config.security.acme.certs.${cfg.domain}.directory}/cert.pem"; + privateKeyFile = "${config.security.acme.certs.${cfg.domain}.directory}/key.pem"; + minimumTLSProtocol = mkDefault "1.2"; + }; + logging.loggers.app = { + name = mkDefault "Application"; + channel = { + class = mkDefault "ConsoleChannel"; + pattern = mkDefault "[%p] %t"; + }; + level = mkDefault "information"; + }; + }; + networking.firewall = lib.mkIf cfg.openFirewall { + allowedUDPPorts = cfg.udpPorts; + allowedTCPPorts = cfg.tcpPorts; + }; + systemd.services.ooklaserver = let + configFile = let + anyToString = arg: if (lib.isBool arg) then + lib.boolToString arg + else if (lib.isList arg) then + lib.concatStringsSep "," (map (val: toString val) arg) + else toString arg; + + in with lib; lib.pipe cfg.settings [ + (mapAttrsRecursive (path: val: "${concatStringsSep "." path} = ${anyToString val}")) + (collect isString) + (concatLines) + (pkgs.writeTextDir "bin/OoklaServer.properties") + ]; + packageWithCfg = pkgs.symlinkJoin { + name = "${cfg.package.name}-with-config"; + paths = [ cfg.package configFile ]; + }; + in { + description = "Ookla speedtest server daemon"; + wantedBy = [ "multi-user.target" ]; + wants = [ "network-online.target" ]; + + serviceConfig = { + Type = "simple"; + Restart = "always"; + User = "ooklaserver"; + Group = "ooklaserver"; + + ExecStart = "${packageWithCfg}/bin/OoklaServer"; + WorkingDirectory = packageWithCfg; + SyslogIdentifier = "ooklaserver"; + + ReadOnlyPaths = [ packageWithCfg ]; + RestrictSUIDSGID = true; + RestrictNamespaces = true; + PrivateTmp = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + ProtectSystem = "strict"; + ProtectHome = true; + ProtectProc = "invisible"; + SystemCallArchitectures = "native"; + SystemCallFilter = "@system-service"; + SystemCallErrorNumber = "EPERM"; + LockPersonality = true; + NoNewPrivileges = true; + }; + }; + }; +}