From 754445e11a2358cc20362b113b78c26e4be7019a Mon Sep 17 00:00:00 2001 From: fruchti Date: Fri, 24 Mar 2023 21:56:32 +0100 Subject: [PATCH] Emitter: Enable remote burp backups to Rupert --- hosts/Emitter.nix | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/hosts/Emitter.nix b/hosts/Emitter.nix index 98c9ea8..3f5cdaf 100644 --- a/hosts/Emitter.nix +++ b/hosts/Emitter.nix @@ -37,6 +37,34 @@ gitUser = "fruchti"; }; + + nixpkgs.overlays = [ + (self: super: { + burp = (super.burp.overrideAttrs (old: { + postInstall = '' + mv $out/sbin/burp $out/sbin/burp-untunneled + cat > $out/sbin/burp <<-EOF + #!/${pkgs.bash}/bin/bash + ${pkgs.openssh}/bin/ssh -i /secrets/id_burp_remote -o IdentitiesOnly=yes -o ExitOnForwardFailure=yes -L 4971:localhost:4971 burp-remote@rupert.gvfr.de -f true + $out/sbin/burp-untunneled \$@ + EOF + chmod +x $out/sbin/burp + ''; + })); + }) + ]; + + services.burp = { + client = { + enable = true; + # Because of the port forward, the server will be localhost + server = "localhost"; + frequency = "2:00"; + passwordFile = "/secrets/burp_client_password"; + sslKeyPasswordFile = "/secrets/burp_ssl_key_password"; + }; + }; + # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It’s perfectly fine and recommended to leave