blob: 727d2fd4f3698bceb929eaa28644612776e9d0c3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.krill;
toml = pkgs.formats.toml { };
in
{
meta = {
maintainers = [ lib.maintainers.stepbrobd ];
teams = [ lib.teams.ngi ];
};
options.services.krill = {
enable = lib.mkEnableOption "Krill, RPKI CA and Publication Server";
package = lib.mkPackageOption pkgs "krill" { };
environmentFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
example = "/run/secrets/krill";
description = ''
Environment file for krill.
Krill requires an admin token to start.
Use this file to provide `KRILL_ADMIN_TOKEN=...`
(e.g. via agenix or sops-nix).
'';
};
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = toml.type;
options = {
storage_uri = lib.mkOption {
type = lib.types.str;
default = "/var/lib/krill/data";
description = ''
Where Krill stores its data e.g. CA keys and the publication repository.
The default keeps it inside service state directory.
'';
};
log_type = lib.mkOption {
type = lib.types.enum [
"stderr"
"file"
"syslog"
];
default = "stderr";
description = "Where Krill logs to.";
};
};
};
default = { };
description = ''
Configuration written to `krill.conf`.
See <https://krill.docs.nlnetlabs.nl/en/stable/config.html> for available options.
'';
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ cfg.package ];
systemd.services.krill = {
description = "Krill RPKI CA and Publication Server";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
Type = "exec";
ExecStart = "${lib.getExe' cfg.package "krill"} --config ${toml.generate "krill.conf" cfg.settings}";
EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
Restart = "on-failure";
RestartSec = 10;
StateDirectory = "krill";
StateDirectoryMode = "0700";
RuntimeDirectory = "krill";
UMask = "0077";
CapabilityBoundingSet = [ "" ];
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallErrorNumber = "EPERM";
SystemCallFilter = "@system-service";
};
};
};
}
|
