Merge pull request #296459 from MinerSebas/restic-rest-server-hardening (a8eaee11) · Commits · nix / nixpkgs

nixos/modules/services/backup/restic-rest-server.nix

+33 −4

Original line number	Diff line number	Diff line
		@@ -12,7 +12,7 @@ in
		enable = mkEnableOption (lib.mdDoc "Restic REST Server");

		listenAddress = mkOption {
		default = ":8000";
		default = "8000";
		example = "127.0.0.1:8080";
		type = types.str;
		description = lib.mdDoc "Listen on a specific IP address and port.";
		@@ -61,14 +61,19 @@ in
		};

		config = mkIf cfg.enable {
		assertions = [{
		assertion = lib.substring 0 1 cfg.listenAddress != ":";
		message = "The restic-rest-server now uses systemd socket activation, which expects only the Port number: services.restic.server.listenAddress = \"${lib.substring 1 6 cfg.listenAddress}\";";
		}];

		systemd.services.restic-rest-server = {
		description = "Restic REST Server";
		after = [ "network.target" ];
		after = [ "network.target" "restic-rest-server.socket" ];
		requires = [ "restic-rest-server.socket" ];
		wantedBy = [ "multi-user.target" ];
		serviceConfig = {
		ExecStart = ''
		${cfg.package}/bin/rest-server \
		--listen ${cfg.listenAddress} \
		--path ${cfg.dataDir} \
		${optionalString cfg.appendOnly "--append-only"} \
		${optionalString cfg.privateRepos "--private-repos"} \
		@@ -80,16 +85,40 @@ in
		Group = "restic";

		# Security hardening
		ReadWritePaths = [ cfg.dataDir ];
		CapabilityBoundingSet = "";
		LockPersonality = true;
		MemoryDenyWriteExecute = true;
		NoNewPrivileges = true;
		PrivateNetwork = true;
		PrivateTmp = true;
		PrivateUsers = true;
		ProtectClock = true;
		ProtectHome = true;
		ProtectHostname = true;
		ProtectKernelLogs = true;
		ProtectProc = "invisible";
		ProtectSystem = "strict";
		ProtectKernelTunables = true;
		ProtectKernelModules = true;
		ProtectControlGroups = true;
		PrivateDevices = true;
		ReadWritePaths = [ cfg.dataDir ];
		RemoveIPC = true;
		RestrictAddressFamilies = "none";
		RestrictNamespaces = true;
		RestrictRealtime = true;
		RestrictSUIDSGID = true;
		SystemCallArchitectures = "native";
		SystemCallFilter = "@system-service";
		UMask = 027;
		};
		};

		systemd.sockets.restic-rest-server = {
		listenStreams = [ cfg.listenAddress ];
		wantedBy = [ "sockets.target" ];
		};

		systemd.tmpfiles.rules = mkIf cfg.privateRepos [
		"f ${cfg.dataDir}/.htpasswd 0700 restic restic -"
		];

nixos/tests/all-tests.nix

+1 −0

Original line number	Diff line number	Diff line
		@@ -777,6 +777,7 @@ in {
		redis = handleTest ./redis.nix {};
		redmine = handleTest ./redmine.nix {};
		restartByActivationScript = handleTest ./restart-by-activation-script.nix {};
		restic-rest-server = handleTest ./restic-rest-server.nix {};
		restic = handleTest ./restic.nix {};
		retroarch = handleTest ./retroarch.nix {};
		rkvm = handleTest ./rkvm {};

nixos/tests/restic-rest-server.nix

0 → 100644

+122 −0

Original line number	Diff line number	Diff line
		import ./make-test-python.nix (
		{ pkgs, ... }:

		let
		remoteRepository = "rest:http://restic_rest_server:8001/";

		backupPrepareCommand = ''
		touch /root/backupPrepareCommand
		test ! -e /root/backupCleanupCommand
		'';

		backupCleanupCommand = ''
		rm /root/backupPrepareCommand
		touch /root/backupCleanupCommand
		'';

		testDir = pkgs.stdenvNoCC.mkDerivation {
		name = "test-files-to-backup";
		unpackPhase = "true";
		installPhase = ''
		mkdir $out
		echo some_file > $out/some_file
		echo some_other_file > $out/some_other_file
		mkdir $out/a_dir
		echo a_file > $out/a_dir/a_file
		'';
		};

		passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
		paths = [ "/opt" ];
		exclude = [ "/opt/excluded_file_*" ];
		pruneOpts = [
		"--keep-daily 2"
		"--keep-weekly 1"
		"--keep-monthly 1"
		"--keep-yearly 99"
		];
		in
		{
		name = "restic-rest-server";

		nodes = {
		restic_rest_server = {
		services.restic.server = {
		enable = true;
		extraFlags = [ "--no-auth" ];
		listenAddress = "8001";
		};
		networking.firewall.allowedTCPPorts = [ 8001 ];
		};
		server = {
		services.restic.backups = {
		remotebackup = {
		inherit passwordFile paths exclude pruneOpts backupPrepareCommand backupCleanupCommand;
		repository = remoteRepository;
		initialize = true;
		timerConfig = null; # has no effect here, just checking that it doesn't break the service
		};
		remoteprune = {
		inherit passwordFile;
		repository = remoteRepository;
		pruneOpts = [ "--keep-last 1" ];
		};
		};
		};
		};

		testScript = ''
		restic_rest_server.start()
		server.start()
		restic_rest_server.wait_for_unit("restic-rest-server.socket")
		restic_rest_server.wait_for_open_port(8001)
		server.wait_for_unit("dbus.socket")
		server.fail(
		"restic-remotebackup snapshots",
		)
		server.succeed(
		# set up
		"cp -rT ${testDir} /opt",
		"touch /opt/excluded_file_1 /opt/excluded_file_2",

		# test that remotebackup runs custom commands and produces a snapshot
		"timedatectl set-time '2016-12-13 13:45'",
		"systemctl start restic-backups-remotebackup.service",
		"rm /root/backupCleanupCommand",
		'restic-remotebackup snapshots --json \| ${pkgs.jq}/bin/jq "length \| . == 1"',

		# test that restoring that snapshot produces the same directory
		"mkdir /tmp/restore-1",
		"restic-remotebackup restore latest -t /tmp/restore-1",
		"diff -ru ${testDir} /tmp/restore-1/opt",

		# test that we can create four snapshots in remotebackup and rclonebackup
		"timedatectl set-time '2017-12-13 13:45'",
		"systemctl start restic-backups-remotebackup.service",
		"rm /root/backupCleanupCommand",

		"timedatectl set-time '2018-12-13 13:45'",
		"systemctl start restic-backups-remotebackup.service",
		"rm /root/backupCleanupCommand",

		"timedatectl set-time '2018-12-14 13:45'",
		"systemctl start restic-backups-remotebackup.service",
		"rm /root/backupCleanupCommand",

		"timedatectl set-time '2018-12-15 13:45'",
		"systemctl start restic-backups-remotebackup.service",
		"rm /root/backupCleanupCommand",

		"timedatectl set-time '2018-12-16 13:45'",
		"systemctl start restic-backups-remotebackup.service",
		"rm /root/backupCleanupCommand",

		'restic-remotebackup snapshots --json \| ${pkgs.jq}/bin/jq "length \| . == 4"',

		# test that remoteprune brings us back to 1 snapshot in remotebackup
		"systemctl start restic-backups-remoteprune.service",
		'restic-remotebackup snapshots --json \| ${pkgs.jq}/bin/jq "length \| . == 1"',
		)
		'';
		}
		)

pkgs/tools/backup/restic/rest-server.nix

+3 −1

Original line number	Diff line number	Diff line
		{ lib, buildGoModule, fetchFromGitHub }:
		{ lib, buildGoModule, fetchFromGitHub, nixosTests }:

		buildGoModule rec {
		pname = "restic-rest-server";
		@@ -13,6 +13,8 @@ buildGoModule rec {

		vendorHash = "sha256-tD5ffIYULMBqu99l1xCL0RnLB9zNpwNPs1qVFqezUc8=";

		passthru.tests.restic = nixosTests.restic-rest-server;

		meta = with lib; {
		changelog = "https://github.com/restic/rest-server/blob/${src.rev}/CHANGELOG.md";
		description = "A high performance HTTP server that implements restic's REST backend API";

Admin message