diff options
author | zaldnoay <zaldnoay@users.noreply.github.com> | 2023-09-13 00:13:15 +0800 |
---|---|---|
committer | Lin Jian <me@linj.tech> | 2023-09-17 14:37:19 +0800 |
commit | 6cd38e43cdaf1bd02013186bbb201f5c62132a77 (patch) | |
tree | 420d5fa37c4c0422b22ff5d92229b0ce4c0668f8 | |
parent | 948e8754755a9f27587d5bd109af2cfad313add8 (diff) | |
download | nixlib-6cd38e43cdaf1bd02013186bbb201f5c62132a77.tar nixlib-6cd38e43cdaf1bd02013186bbb201f5c62132a77.tar.gz nixlib-6cd38e43cdaf1bd02013186bbb201f5c62132a77.tar.bz2 nixlib-6cd38e43cdaf1bd02013186bbb201f5c62132a77.tar.lz nixlib-6cd38e43cdaf1bd02013186bbb201f5c62132a77.tar.xz nixlib-6cd38e43cdaf1bd02013186bbb201f5c62132a77.tar.zst nixlib-6cd38e43cdaf1bd02013186bbb201f5c62132a77.zip |
nixos/frp: init
-rw-r--r-- | nixos/doc/manual/release-notes/rl-2311.section.md | 2 | ||||
-rw-r--r-- | nixos/modules/module-list.nix | 1 | ||||
-rw-r--r-- | nixos/modules/services/networking/frp.nix | 93 |
3 files changed, 96 insertions, 0 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md index 9b30a20da162..82dbe187d957 100644 --- a/nixos/doc/manual/release-notes/rl-2311.section.md +++ b/nixos/doc/manual/release-notes/rl-2311.section.md @@ -16,6 +16,8 @@ - [acme-dns](https://github.com/joohoi/acme-dns), a limited DNS server to handle ACME DNS challenges easily and securely. Available as [services.acme-dns](#opt-services.acme-dns.enable). +- [frp](https://github.com/fatedier/frp), a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet. Available as [services.frp](#opt-services.frp.enable). + <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> - [river](https://github.com/riverwm/river), A dynamic tiling wayland compositor. Available as [programs.river](#opt-programs.river.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 84bc189bd55f..811a46563fb4 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -899,6 +899,7 @@ ./services/networking/flannel.nix ./services/networking/freenet.nix ./services/networking/freeradius.nix + ./services/networking/frp.nix ./services/networking/frr.nix ./services/networking/gateone.nix ./services/networking/gdomap.nix diff --git a/nixos/modules/services/networking/frp.nix b/nixos/modules/services/networking/frp.nix new file mode 100644 index 000000000000..09d2b7736302 --- /dev/null +++ b/nixos/modules/services/networking/frp.nix @@ -0,0 +1,93 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.frp; + settingsFormat = pkgs.formats.ini { }; + configFile = settingsFormat.generate "frp.ini" cfg.settings; + isClient = (cfg.role == "client"); + isServer = (cfg.role == "server"); +in +{ + options = { + services.frp = { + enable = mkEnableOption (mdDoc "frp"); + + package = mkPackageOptionMD pkgs "frp" { }; + + role = mkOption { + type = types.enum [ "server" "client" ]; + description = mdDoc '' + The frp consists of `client` and `server`. The server is usually + deployed on the machine with a public IP address, and + the client is usually deployed on the machine + where the Intranet service to be penetrated resides. + ''; + }; + + settings = mkOption { + type = settingsFormat.type; + default = { }; + description = mdDoc '' + Frp configuration, for configuration options + see the example of [client](https://github.com/fatedier/frp/blob/dev/conf/frpc_full.ini) + or [server](https://github.com/fatedier/frp/blob/dev/conf/frps_full.ini) on github. + ''; + example = literalExpression '' + { + common = { + server_addr = "x.x.x.x"; + server_port = 7000; + }; + } + ''; + }; + }; + }; + + config = + let + serviceCapability = optionals isServer [ "CAP_NET_BIND_SERVICE" ]; + executableFile = if isClient then "frpc" else "frps"; + in + mkIf cfg.enable { + systemd.services = { + frp = { + wants = optionals isClient [ "network-online.target" ]; + after = if isClient then [ "network-online.target" ] else [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + description = "A fast reverse proxy frp ${cfg.role}"; + serviceConfig = { + Type = "simple"; + Restart = "on-failure"; + RestartSec = 15; + ExecStart = "${cfg.package}/bin/${executableFile} -c ${configFile}"; + StateDirectoryMode = optionalString isServer "0700"; + DynamicUser = true; + # Hardening + UMask = optionalString isServer "0007"; + CapabilityBoundingSet = serviceCapability; + AmbientCapabilities = serviceCapability; + PrivateDevices = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ] ++ optionals isClient [ "AF_UNIX" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + PrivateMounts = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" ]; + }; + }; + }; + }; + + meta.maintainers = with maintainers; [ zaldnoay ]; +} |