Unverified Commit 3ae07e6d authored by Defelo's avatar Defelo
Browse files

nixos/whoami: init module

parent abedfe08

nixos/doc/manual/release-notes/rl-2505.section.md

+2 −0
Original line number Diff line number Diff line
@@ -187,6 +187,8 @@ 


- [echoip](https://github.com/mpolden/echoip), a simple service for looking up your IP address. Available as [services.echoip](#opt-services.echoip.enable).



- [whoami](https://github.com/traefik/whoami), a tiny Go server that prints OS information and HTTP request to output. Available as [services.whoami](#opt-services.whoami.enable).



- [LiteLLM](https://github.com/BerriAI/litellm), a LLM Gateway to provide model access, fallbacks and spend tracking across 100+ LLMs. All in the OpenAI format. Available as [services.litellm](#opt-services.litellm.enable).



- [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard).

nixos/modules/module-list.nix

+1 −0
Original line number Diff line number Diff line
@@ -1636,6 +1636,7 @@ 
  ./services/web-apps/wakapi.nix

  ./services/web-apps/weblate.nix

  ./services/web-apps/whitebophir.nix

  ./services/web-apps/whoami.nix

  ./services/web-apps/wiki-js.nix

  ./services/web-apps/windmill.nix

  ./services/web-apps/wordpress.nix

nixos/modules/services/web-apps/whoami.nix

0 → 100644
+90 −0
Original line number Diff line number Diff line 
{

  config,

  lib,

  pkgs,

  ...

}:



let

  cfg = config.services.whoami;

in



{

  meta.maintainers = with lib.maintainers; [ defelo ];



  options.services.whoami = {

    enable = lib.mkEnableOption "whoami";



    package = lib.mkPackageOption pkgs "whoami" { };



    port = lib.mkOption {

      type = lib.types.port;

      description = "The port whoami should listen on.";

      default = 8000;

    };



    extraArgs = lib.mkOption {

      type = lib.types.listOf lib.types.str;

      description = "Extra command line arguments to pass to whoami. See <https://github.com/traefik/whoami#flags> for details.";

      default = [ ];

    };

  };



  config = lib.mkIf cfg.enable {

    systemd.services.whoami = {

      wantedBy = [ "multi-user.target" ];



      wants = [ "network-online.target" ];

      after = [ "network-online.target" ];



      serviceConfig = {

        User = "whoami";

        Group = "whoami";

        DynamicUser = true;

        ExecStart = lib.escapeShellArgs (

          [

            (lib.getExe cfg.package)

            "-port"

            cfg.port

          ]

          ++ cfg.extraArgs

        );



        # Hardening

        AmbientCapabilities = "";

        CapabilityBoundingSet = [ "" ];

        DevicePolicy = "closed";

        LockPersonality = true;

        MemoryDenyWriteExecute = true;

        NoNewPrivileges = true;

        PrivateDevices = true;

        PrivateTmp = true;

        PrivateUsers = true;

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        RemoveIPC = true;

        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        SocketBindAllow = "tcp:${toString cfg.port}";

        SocketBindDeny = "any";

        SystemCallArchitectures = "native";

        SystemCallFilter = [

          "@system-service"

          "~@privileged"

          "~@resources"

        ];

        UMask = "0077";

      };

    };

  };

}