Unverified Commit f88f5fec authored by Sandro Jäckel's avatar Sandro Jäckel Committed by GitHub
Browse files

Merge pull request #318933 from mweinelt/vaultharden 

nixos/vaultwarden: update state directory name, harden systemd unit
parents 23b61779 be53df72

nixos/doc/manual/release-notes/rl-2411.section.md

+4 −0
Original line number Diff line number Diff line
@@ -37,6 +37,10 @@ 


- `services.ddclient.use` has been deprecated: `ddclient` now supports separate IPv4 and IPv6 configuration. Use `services.ddclient.usev4` and `services.ddclient.usev6` instead.



- `vaultwarden` lost the capability to bind to privileged ports. If you rely on

   this behavior, override the systemd unit to allow `CAP_NET_BIND_SERVICE` in

   your local configuration.



- The Invoiceplane module now only accepts the structured `settings` option.

  `extraConfig` is now removed.

nixos/modules/services/security/vaultwarden/default.nix

+39 −8
Original line number Diff line number Diff line
@@ -5,6 +5,8 @@ let 
  user = config.users.users.vaultwarden.name;

  group = config.users.groups.vaultwarden.name;



  StateDirectory = if lib.versionOlder config.system.stateVersion "24.11" then "bitwarden_rs" else "vaultwarden";



  # Convert name from camel case (e.g. disable2FARemember) to upper case snake case (e.g. DISABLE_2FA_REMEMBER).

  nameToEnvVar = name:

    let
@@ -23,7 +25,7 @@ let 
      configEnv = lib.concatMapAttrs (name: value: lib.optionalAttrs (value != null) {

        ${nameToEnvVar name} = if lib.isBool value then lib.boolToString value else toString value;

      }) cfg.config;

    in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // lib.optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {

    in { DATA_FOLDER = "/var/lib/${StateDirectory}"; } // lib.optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {

      WEB_VAULT_FOLDER = "${cfg.webVaultPackage}/share/vaultwarden/vault";

    } // configEnv;
@@ -176,16 +178,45 @@ in { 
        User = user;

        Group = group;

        EnvironmentFile = [ configFile ] ++ lib.optional (cfg.environmentFile != null) cfg.environmentFile;

        ExecStart = "${vaultwarden}/bin/vaultwarden";

        ExecStart = lib.getExe vaultwarden;

        LimitNOFILE = "1048576";

        PrivateTmp = "true";

        PrivateDevices = "true";

        ProtectHome = "true";

        CapabilityBoundingSet = [ "" ];

        DeviceAllow = [ "" ];

        DevicePolicy = "closed";

        LockPersonality = true;

        MemoryDenyWriteExecute = true;

        NoNewPrivileges = true;

        PrivateDevices = true;

        PrivateTmp = true;

        PrivateUsers = true;

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "noaccess";

        ProtectSystem = "strict";

        AmbientCapabilities = "CAP_NET_BIND_SERVICE";

        StateDirectory = "bitwarden_rs";

        RemoveIPC = true;

        RestrictAddressFamilies = [

          "AF_INET"

          "AF_INET6"

          "AF_UNIX"

        ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        inherit StateDirectory;

        StateDirectoryMode = "0700";

        SystemCallArchitectures = "native";

        SystemCallFilter = [

          "@system-service"

          "~@privileged"

        ];

        Restart = "always";

        UMask = "0077";

      };

      wantedBy = [ "multi-user.target" ];

    };
@@ -193,7 +224,7 @@ in { 
    systemd.services.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {

      description = "Backup vaultwarden";

      environment = {

        DATA_FOLDER = "/var/lib/bitwarden_rs";

        DATA_FOLDER = "/var/lib/${StateDirectory}";

        BACKUP_FOLDER = cfg.backupDir;

      };

      path = with pkgs; [ sqlite ];

nixos/tests/vaultwarden.nix

+9 −6
Original line number Diff line number Diff line
@@ -34,7 +34,7 @@ let 
      driver = Firefox(options=options)



      driver.implicitly_wait(20)

      driver.get('http://localhost/#/register')

      driver.get('http://localhost:8080/#/register')



      wait = WebDriverWait(driver, 10)
@@ -134,11 +134,11 @@ let 
            dbBackend = backend;

            config = {

              rocketAddress = "0.0.0.0";

              rocketPort = 80;

              rocketPort = 8080;

            };

          };



          networking.firewall.allowedTCPPorts = [ 80 ];

          networking.firewall.allowedTCPPorts = [ 8080 ];



          environment.systemPackages = [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];

        }
@@ -152,10 +152,10 @@ let 
    testScript = if testScript != null then testScript else ''

      start_all()

      server.wait_for_unit("vaultwarden.service")

      server.wait_for_open_port(80)

      server.wait_for_open_port(8080)



      with subtest("configure the cli"):

          client.succeed("bw --nointeraction config server http://server")

          client.succeed("bw --nointeraction config server http://server:8080")



      with subtest("can't login to nonexistent account"):

          client.fail(
@@ -179,6 +179,9 @@ let 
              timeout=60

          )

          assert password.strip() == "${storedPassword}"



      with subtest("Check systemd unit hardening"):

          server.log(server.succeed("systemd-analyze security vaultwarden.service | grep -v ✓"))

    '';

  });

in
@@ -193,7 +196,7 @@ builtins.mapAttrs (k: v: makeVaultwardenTest k v) { 
    testScript = ''

      start_all()

      server.wait_for_unit("vaultwarden.service")

      server.wait_for_open_port(80)

      server.wait_for_open_port(8080)



      with subtest("Set up vaultwarden"):

          server.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")