From 3771134e3ad770a5b571d40b56aaf921c410cb00 Mon Sep 17 00:00:00 2001 From: xinyangli Date: Tue, 9 Jul 2024 21:17:10 +0800 Subject: [PATCH] overlays: add oidc-agent --- flake.lock | 8 +- flake.nix | 2 +- home/xin/common/default.nix | 1 - machines/calcite/configuration.nix | 14 ++- modules/home-manager/vscode.nix | 2 +- modules/nixos/default.nix | 1 + modules/nixos/inbounds.nix | 126 +++++++++++++++++++++++++++ modules/nixos/oidc-agent.nix | 50 +++++++++++ overlays/add-pkgs.nix | 2 + overlays/pkgs/oidc-agent/default.nix | 58 ++++++++++++ 10 files changed, 256 insertions(+), 8 deletions(-) create mode 100644 modules/nixos/inbounds.nix create mode 100644 modules/nixos/oidc-agent.nix create mode 100644 overlays/pkgs/oidc-agent/default.nix diff --git a/flake.lock b/flake.lock index a1c98d7..5b6c4a9 100644 --- a/flake.lock +++ b/flake.lock @@ -174,17 +174,17 @@ }, "nixpkgs": { "locked": { - "lastModified": 1716948383, - "narHash": "sha256-SzDKxseEcHR5KzPXLwsemyTR/kaM9whxeiJohbL04rs=", + "lastModified": 1718870667, + "narHash": "sha256-jab3Kpc8O1z3qxwVsCMHL4+18n5Wy/HHKyu1fcsF7gs=", "owner": "nixos", "repo": "nixpkgs", - "rev": "ad57eef4ef0659193044870c731987a6df5cf56b", + "rev": "9b10b8f00cb5494795e5f51b39210fed4d2b0748", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixos-unstable", "repo": "nixpkgs", + "rev": "9b10b8f00cb5494795e5f51b39210fed4d2b0748", "type": "github" } }, diff --git a/flake.nix b/flake.nix index fe3632d..f01c389 100644 --- a/flake.nix +++ b/flake.nix @@ -1,7 +1,7 @@ { inputs = { # Pin nixpkgs to a specific commit - nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; + nixpkgs.url = "github:nixos/nixpkgs/9b10b8f00cb5494795e5f51b39210fed4d2b0748"; nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-23.05"; home-manager = { diff --git a/home/xin/common/default.nix b/home/xin/common/default.nix index d4bc579..c5b2817 100644 --- a/home/xin/common/default.nix +++ b/home/xin/common/default.nix @@ -14,7 +14,6 @@ tmux ffmpeg tealdeer - neofetch rclone inetutils diff --git a/machines/calcite/configuration.nix b/machines/calcite/configuration.nix index d53496a..7de3001 100644 --- a/machines/calcite/configuration.nix +++ b/machines/calcite/configuration.nix @@ -40,6 +40,17 @@ gamescopeSession = { enable = true; }; }; + programs.oidc-agent.enable = true; + programs.oidc-agent.providers = [ + { issuer = "https://home.xinyang.life:9201"; + pubclient = { + client_id = "xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69"; + client_secret = "UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh"; + scope = "openid offline_access profile email"; + }; + } + ]; + programs.vim.defaultEditor = true; # Keep this even if enabled in home manager @@ -97,7 +108,7 @@ # Enable CUPS to print documents. services.printing.enable = true; - services.printing.drivers = [ pkgs.hplip ]; + # services.printing.drivers = [ pkgs.hplip ]; # Enable sound with pipewire. sound.enable = true; @@ -145,6 +156,7 @@ # List packages installed in system profile. To search, run: # $ nix search wget environment.systemPackages = with pkgs; [ + oidc-agent # Filesystem owncloud-client nfs-utils diff --git a/modules/home-manager/vscode.nix b/modules/home-manager/vscode.nix index 6405310..e08eedb 100644 --- a/modules/home-manager/vscode.nix +++ b/modules/home-manager/vscode.nix @@ -17,7 +17,7 @@ let }; }; cxxPackages = { - systemPackages = with pkgs; [ clang-tools ]; + systemPackages = with pkgs; [ clang-tools cmake-format ]; extension = with inputs.nix-vscode-extensions.extensions.${pkgs.system}.vscode-marketplace; [ llvm-vs-code-extensions.vscode-clangd (ms-vscode.cmake-tools.overrideAttrs (_: { sourceRoot = "extension"; })) diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index a19ba87..c3d43a0 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -9,5 +9,6 @@ ./kanidm-client.nix ./ssh-tpm-agent.nix # FIXME: Waiting for upstream merge ./forgejo-actions-runner.nix + ./oidc-agent.nix ]; } diff --git a/modules/nixos/inbounds.nix b/modules/nixos/inbounds.nix new file mode 100644 index 0000000..0cbd33f --- /dev/null +++ b/modules/nixos/inbounds.nix @@ -0,0 +1,126 @@ +{ config +, lib +, ... }: +let + cfg = config.custom.sing-box-server; + + secretFileType = lib.types.submodule { + _secret = lib.types.path; + }; + singTls = { + enabled = true; + server_name = config.deployment.targetHost; + key_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/key.pem"; + certificate_path = config.security.acme.certs.${config.deployment.targetHost}.directory + "/cert.pem"; + }; +in +{ + options = { + enable = lib.mkEnableOption "sing-box proxy server"; + users = lib.types.listOf lib.types.submodule { + name = lib.mkOption { + type = lib.types.str; + default = "proxy"; + }; + password = lib.mkOption { + type = secretFileType; + }; + uuid = lib.mkOption { + type = secretFileType; + }; + }; + wgOut = { + privKeyFile = lib.mkOption { + type = lib.types.path; + }; + pubkey = lib.mkOption { + type = lib.types.str; + default = "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo="; + }; + }; + inbounds = { + trojan = { + enable = lib.mkOption { + type = lib.types.bool; + default = true; + }; + }; + tuic = { + enable = lib.mkOption { + type = lib.types.bool; + default = true; + }; + ports = lib.mkOption { + type = lib.types.listOf lib.types.int; + default = lib.range 6311 6313; + }; + directPorts = lib.mkOption { + type = lib.types.listOf lib.types.int; + default = [ 6314 ]; + }; + }; + }; + }; + config = lib.mkIf cfg.enable { + services.sing-box = { + enable = true; + settings = { + dns = { + servers = [ + { + address = "1.1.1.1"; + detour = "wg-out"; + } + ]; + }; + inbounds = [ + # TODO: Trojan and tuic enable + { + tag = "trojan-in"; + type = "trojan"; + listen = "::"; + listen_port = 8080; + users = map (u: removeAttrs u [ "uuid" ]) cfg.users; + tls = singTls; + } + ] ++ lib.forEach (cfg.tuic.ports ++ cfg.tuic.directPorts) (port: { + tag = "tuic-in" + toString port; + type = "tuic"; + listen = "::"; + listen_port = port; + congestion_control = "bbr"; + users = cfg.users; + tls = singTls; + }); + outbounds = [ + { + type = "wireguard"; + tag = "wg-out"; + private_key = cfg.wgOut.privKeyFile; + local_address = [ + "172.16.0.2/32" + "2606:4700:110:82ed:a443:3c62:6cbc:b59b/128" + ]; + peers = [ + { public_key= cfg.wgOut.pubkey; + allowed_ips = [ "0.0.0.0/0" "::/0" ]; + server = "162.159.192.1"; + server_port = 500; + } + ]; + } + { type = "direct"; tag = "direct-out"; } + { type = "dns"; tag = "dns-out"; } + ]; + route = { + rules = [ + { outbound = "dns-out"; protocol = "dns"; } + ] ++ lib.forEach cfg.tuic.directPorts (port: { + inbound = "tuic-in" + toString port; + outbound = "direct-out"; + }); + }; + }; + }; + }; +} \ No newline at end of file diff --git a/modules/nixos/oidc-agent.nix b/modules/nixos/oidc-agent.nix new file mode 100644 index 0000000..35ce679 --- /dev/null +++ b/modules/nixos/oidc-agent.nix @@ -0,0 +1,50 @@ +{ config, lib, pkgs, ... }: + +let + inherit (lib) mkIf mkEnableOption mkOption types; + + cfg = config.programs.oidc-agent; + providerFormat = pkgs.formats.json {}; +in +{ + options.programs.oidc-agent = { + enable = mkEnableOption "OpenID Connect Agent"; + package = mkOption { + type = types.package; + default = pkgs.oidc-agent; + description = '' + Which oidc-agent package to use + ''; + }; + providers = mkOption { + type = providerFormat.type; + default = {}; + description = '' + Configuration of providers which contains a json array of json objects + each describing an issuer, see https://indigo-dc.gitbook.io/oidc-agent/configuration/issuers + ''; + }; + }; + + config = mkIf cfg.enable { + systemd.user.services.oidc-agent = { + unitConfig = { + Description = "OpenID Connect Agent"; + Documentation = "man:oidc-agent(1)"; + }; + serviceConfig = { + ExecStart = "${cfg.package}/bin/oidc-agent -d --log-stderr -a %t/oidc-agent"; + }; + }; + + # environment.etc."oidc-agent/config".source = "${pkgs.oidc-agent}/etc/oidc-agent/config"; + + # environment.etc."oidc-agent/issuer.config.d".source = + # "${pkgs.oidc-agent}/etc/oidc-agent/issuer.config.d"; + + # environment.etc."oidc-agent/issuer.config".source = + # providerFormat.generate "oidc-agent-issuer.config" cfg.providers; + + environment.extraInit = ''export OIDC_SOCK="$XDG_RUNTIME_DIR/oidc-agent"''; + }; +} diff --git a/overlays/add-pkgs.nix b/overlays/add-pkgs.nix index 021dfcb..ce339b0 100644 --- a/overlays/add-pkgs.nix +++ b/overlays/add-pkgs.nix @@ -3,6 +3,8 @@ { nixpkgs.overlays = [ (self: super: { + oidc-agent = pkgs.callPackage ./pkgs/oidc-agent { }; + python3 = super.python312; }) ]; } diff --git a/overlays/pkgs/oidc-agent/default.nix b/overlays/pkgs/oidc-agent/default.nix new file mode 100644 index 0000000..42f398e --- /dev/null +++ b/overlays/pkgs/oidc-agent/default.nix @@ -0,0 +1,58 @@ +{ lib +, stdenv +, fetchFromGitHub +, curl +, webkitgtk +, libmicrohttpd +, libsecret +, qrencode +, libsodium +, pkg-config +, help2man +}: + +stdenv.mkDerivation rec { + pname = "oidc-agent"; + version = "5.1.0"; + + src = fetchFromGitHub { + owner = "indigo-dc"; + repo = "oidc-agent"; + rev = "v${version}"; + sha256 = "sha256-cOK/rZ/jnyALLuhDM3+qvwwe4Fjkv8diQBkw7NfVo0c=" + ; + }; + + buildInputs = [ + pkg-config + help2man + ]; + nativeBuildInputs = [ + curl + webkitgtk + libmicrohttpd + libsecret + qrencode + libsodium + ]; + enableParallelBuilding = true; + + installPhase = '' + make -j $NIX_BUILD_CORES PREFIX=$out BIN_PATH=$out LIB_PATH=$out/lib \ + install_bin install_lib install_conf + ''; + postFixup = '' + # Override with patched binary to be used by help2man + cp -r $out/bin/* bin + make install_man PREFIX=$out + ''; + + + meta = with lib; { + description = "oidc-agent for managing OpenID Connect tokens on the command line"; + homepage = "https://github.com/indigo-dc/oidc-agent"; + maintainers = [ ]; + license = licenses.mit; + }; +} +