{ config, lib, pkgs, ... }: with lib; let libDir = "/var/lib/burp"; clientCertDir = "${libDir}/CA-client"; cfg = config.services.burp; clientConf = pkgs.writeText "burp.conf" '' mode = client pidfile = /run/burp/burp.pid port = ${toString cfg.client.port} status_port = ${toString cfg.client.statusPort} server = ${cfg.client.server} password = ${if (cfg.client.passwordFile != null) then "#PASSWORD#" else cfg.client.password} cname = ${cfg.client.clientName} ca_burp_ca = ${cfg.package}/bin/burp_ca ca_csr_dir = ${clientCertDir} ssl_cert_ca = ${libDir}/ssl_cert_ca.pem ssl_cert = ${libDir}/ssl_cert-client.pem ssl_key = ${libDir}/ssl_cert-client.key ssl_key_password = ${if (cfg.client.sslKeyPasswordFile != null) then "#SSL_KEY_PASSWORD#" else cfg.client.sslKeyPassword} ssl_peer_cn = burpserver ${concatMapStringsSep "\n" (x: "include = " + x) cfg.client.includes} ${concatMapStringsSep "\n" (x: "exclude = " + x) cfg.client.excludes} nobackup = .nobackup ${optionalString (cfg.client.encryptionPasswordFile != null) '' encryption_password = #ENCRYPTION_PASSWORD# ''} ${cfg.client.extraConfig} ''; serverHome = "/var/lib/burp"; serverClientConfDir = serverHome + "/clientconfdir"; serverCaConf = pkgs.writeText "CA.cnf" '' CA_DIR = ${serverHome}/CA [ ca ] dir = $ENV::CA_DIR database = $dir/index.txt serial = $dir/serial.txt certs = $dir/certs new_certs_dir = $dir/newcerts crlnumber = $dir/crlnumber.txt unique_subject = no default_md = sha256 default_days = 7300 default_crl_days = 7300 #???? name_opt = ca_default cert_opt = ca_default x509_extensions = usr_cert copy_extensions = copy policy = policy_anything [ usr_cert ] basicConstraints = CA:FALSE [ policy_anything ] commonName = supplied ''; serverConf = pkgs.writeText "burp-server.conf" '' mode = server pidfile = /run/burp/burp-server.pid listen = ${cfg.server.listen} max_children = 5; listen_status = ${cfg.server.listenStatus} max_status_children = 5; user = burp group = burp umask = 0022 clientconfdir = ${serverClientConfDir} directory = ${cfg.server.dataDirectory} ca_conf = ${serverCaConf} ca_name = burpCA ca_server_name = burpserver ca_burp_ca = ${cfg.package}/bin/burp_ca ca_crl_check = 1 ssl_cert_ca = ${serverHome}/ssl_cert_ca.pem ssl_cert = ${serverHome}/ssl_cert-server.pem ssl_key = ${serverHome}/ssl_cert-server.key ssl_dhfile = ${serverHome}/dhfile.pem ssl_key_password = ${if (cfg.server.sslKeyPasswordFile != null) then "#SSL_KEY_PASSWORD#" else cfg.server.sslKeyPassword} ${concatMapStringsSep "\n" (x: "keep = " + toString x) cfg.server.keep} timer_script = ${cfg.server.timerScript} ${concatMapStringsSep "\n" (x: "timer_arg = " + x) cfg.server.timerArgs} dedup_group = global working_dir_recovery_method = ${cfg.server.workingDirRecoveryMethod} max_resume_attempts = ${toString cfg.server.maxResumeAttempts} ${concatMapStringsSep "\n" (x: "super_client = " + x) cfg.server.superClients} ${concatMapStringsSep "\n" (x: "restore_client = " + x) cfg.server.restoreClients} ${cfg.server.extraConfig} ''; clientConfigs = lib.attrsets.mapAttrs (name: config: (pkgs.writeText name '' password = ${if (config.passwordFile != null) then "#PASSWORD#" else config.password} ${config.extraConfig} '')) cfg.server.clients; in { options = { services.burp.package = mkOption { type = types.package; default = pkgs.burp; description = '' The package which is used as a burp server/client. ''; }; services.burp.server = { enable = mkEnableOption "Burp server"; listen = mkOption { type = types.str; default = ":::4971"; description = '' Listen address used for backup communication. ''; }; listenStatus = mkOption { type = types.str; default = ":::4972"; description = '' Listen address used for querying backup and server status. ''; }; dataDirectory = mkOption { type = types.str; default = "/var/spool/burp"; description = '' Where the backup data is stored. ''; }; sslKeyPassword = mkOption { type = types.str; default = "change-this-password"; description = '' SSL key password for loading a certificate with encryption. ''; }; sslKeyPasswordFile = mkOption { type = types.nullOr types.str; default = null; description = mdDoc '' File to load an SSL key password for loading a certificate with encryption from. Takes preference over `sslKeyPassword`. ''; }; keep = mkOption { type = types.listOf types.int; default = [ 7 ]; description = '' How many backups to keep. ''; }; timerScript = mkOption { type = types.str; default = "${cfg.package}/share/burp/scripts/timer_script"; description = '' Timer script used to evaluate if it's backup time. ''; }; timerArgs = mkOption { type = types.listOf types.str; default = [ "20h" "Mon,Tue,Wed,Thu,Fri,00,01,02,03,04,05,19,20,21,22,23" "Sat,Sun,00,01,02,03,04,05,06,07,08,17,18,19,20,21,22,23" ]; description = '' How often should backups be triggered. ''; }; superClients = mkOption { type = types.listOf types.str; default = []; description = '' Clients that are permitted to list, verify, restore, delete, and diff files belonging to any other client, according to the super_client's client_can permissions (eg, 'client_can_list'). If this is too permissive, you may set a super_client for individual original clients in the individual clientconfdir files, or look at the 'restoreClients' option. ''; }; restoreClients = mkOption { type = types.listOf types.str; default = []; description = '' Clients that are permitted to list, verify, restore, delete, and diff files belonging to any other client, according to the client_can permissions on both the restore_client and the original_client (eg, 'client_can_list'). If this is too permissive, you may set a restoreClient for individual original clients in the individual clientconfdir files. ''; }; workingDirRecoveryMethod = mkOption { type = types.str; default = "delete"; description = '' This option tells the server what to do when it finds the working directory of an interrupted backup (perhaps somebody pulled the plug on the server, or something). This can be overridden by the client configurations files in clientconfdir on the server. Options are... delete: Just delete the old working directory. resume: Continue the previous backup from the point at which it left off. NOTE: If the client has changed its include/exclude configuration since the backup was interrupted, the recovery method will automatically switch to 'delete'. See also the 'resume attempts' option. ''; }; maxResumeAttempts = mkOption { type = types.int; default = 0; description = '' If workingDirRecoveryMethod is 'resume', this option tells the server how many times to attempt to resume before giving up and deleting the working directory. The default is 0, which means to never give up. ''; }; clients = mkOption { type = types.attrsOf (types.submodule ({ ... }: { options = { password = mkOption { type = types.str; default = "change-this-password"; description = '' Password used by the client for first contact with the server. ''; }; passwordFile = mkOption { type = types.nullOr types.str; default = null; description = mdDoc '' File to load a password for the first contact from client to server from. Takes preference over `password`. ''; }; extraConfig = mkOption { type = types.lines; default = ""; description = '' Extra configuration for burp client. Contents will be added verbatim to the configuration file. ''; }; }; })); }; extraConfig = mkOption { type = types.lines; default = ""; description = '' Extra configuration for burp client. Contents will be added verbatim to the configuration file. ''; }; }; services.burp.client = { enable = mkEnableOption "Burp client"; frequency = mkOption { type = types.str; default = "hourly"; description = '' Controls how frequently the systemd timer is triggered and a backup is attempted. Backup frequency is still determined by the server, this controls only how often the client tries. ''; }; server = mkOption { type = types.str; default = "127.0.0.1"; description = '' Address of burp server the client should contact. ''; }; port = mkOption { type = types.port; default = 4971; description = '' Port used for backup communication. ''; }; statusPort = mkOption { type = types.port; default = 4972; description = '' Port used for querying backup and server status. ''; }; clientName = mkOption { type = types.str; default = "${config.networking.hostName}"; description = '' Name the client should use to identify itself to the server. ''; }; password = mkOption { type = types.str; default = "change-this-password"; description = '' Password used by the client for first contact with the server. ''; }; passwordFile = mkOption { type = types.nullOr types.str; default = null; description = mdDoc '' File to load a password for the first contact from client to server from. Takes preference over `password`. ''; }; sslKeyPassword = mkOption { type = types.str; default = "change-this-password"; description = '' SSL key password for loading a certificate with encryption. ''; }; sslKeyPasswordFile = mkOption { type = types.nullOr types.str; default = null; description = mdDoc '' File to load an SSL key password for loading a certificate with encryption from. Takes preference over `sslKeyPassword`. ''; }; includes = mkOption { type = types.listOf types.str; default = [ "/etc" "/root" "/var" "/home" ]; description = '' List of locations to include in backups. ''; }; excludes = mkOption { type = types.listOf types.str; default = [ libDir ]; description = '' List of locations to exclude from the backup. ''; }; encryptionPasswordFile = mkOption { type = types.nullOr types.str; default = null; description = '' File with a password for encrypted backups. ''; }; extraConfig = mkOption { type = types.lines; default = ""; description = '' Extra configuration for burp client. Contents will be added verbatim to the configuration file. ''; }; }; }; config = { environment.systemPackages = mkIf cfg.client.enable [ cfg.package ]; systemd.timers.burp-client = mkIf cfg.client.enable { description = "Timer for triggering Burp client and start a backup"; wantedBy = [ "timers.target" ]; timerConfig = { OnCalendar = cfg.client.frequency; Unit = "burp-client.service"; }; }; systemd.services.burp-client = mkIf cfg.client.enable { description = "Burp client"; after = [ "network.target" ]; path = [ cfg.package pkgs.nettools pkgs.openssl ]; preStart = let configFile = "${libDir}/burp.conf"; replaceSecret = "${pkgs.replace-secret}/bin/replace-secret"; in '' prepare_config() { umask 027 install -Dm640 ${clientConf} '${configFile}' ${optionalString (cfg.client.passwordFile != null) '' ${replaceSecret} '#PASSWORD#' '${cfg.client.passwordFile}' '${configFile}' ''} ${optionalString (cfg.client.sslKeyPasswordFile != null) '' ${replaceSecret} '#SSL_KEY_PASSWORD#' '${cfg.client.sslKeyPasswordFile}' '${configFile}' ''} ${optionalString (cfg.client.encryptionPasswordFile != null) '' ${replaceSecret} '#ENCRYPTION_PASSWORD#' '${cfg.client.encryptionPasswordFile}' '${configFile}' ''} } if [ ! -d "${libDir}" ]; then mkdir -m 0750 -p ${libDir} mkdir -m 0700 -p ${clientCertDir} prepare_config ${cfg.package}/bin/burp -c '${configFile}' -g else prepare_config fi ''; serviceConfig = { Type = "simple"; ExecStart = "${cfg.package}/bin/burp -c ${libDir}/burp.conf -a t"; SuccessExitStatus = "3"; }; }; users = mkIf cfg.server.enable { users.burp = { group = "burp"; uid = 497; home = "${serverHome}"; createHome = true; description = "Burp Server user"; shell = "${pkgs.bash}/bin/bash"; isSystemUser = true; }; groups.burp = { gid = 497; }; }; systemd.services.burp-server = mkIf cfg.server.enable { description = "Burp Server"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; path = [ cfg.package pkgs.nettools pkgs.openssl ]; serviceConfig = let configFile = "${serverHome}/burp-server.conf"; replaceSecret = "${pkgs.replace-secret}/bin/replace-secret"; preStartScript = pkgs.writeScript "burp-server-prestart" '' #!/${pkgs.bash}/bin/bash prepare_data_directory() { if ! [ -d "${cfg.server.dataDirectory}" ] ; then mkdir -p "${cfg.server.dataDirectory}" fi chown burp:burp "${cfg.server.dataDirectory}" "${serverClientConfDir}" chmod 700 "${cfg.server.dataDirectory}" } prepare_config() { install -Dm640 -o burp -g burp '${serverConf}' '${configFile}' ${optionalString (cfg.server.sslKeyPasswordFile != null) '' ${replaceSecret} '#SSL_KEY_PASSWORD#' '${cfg.server.sslKeyPasswordFile}' '${configFile}' ''} } prepare_client_configs() { umask 077 if ! [ -d "${serverClientConfDir}" ] ; then mkdir -p "${serverClientConfDir}" fi rm -f "${serverClientConfDir}"/* ${concatStringsSep "\n" (mapAttrsToList(name: file: '' install -Dm640 -o burp -g burp '${file}' '${serverClientConfDir}/${name}' ${optionalString (cfg.server.clients.${name}.passwordFile != null) '' ${replaceSecret} '#PASSWORD#' '${cfg.server.clients.${name}.passwordFile}' '${serverClientConfDir}/${name}' ''} '') clientConfigs)} } prepare_data_directory prepare_config prepare_client_configs ''; in { ExecStart = "${cfg.package}/bin/burp -F -v -c ${configFile}"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; User = "burp"; Group = "burp"; UMask = "0077"; RuntimeDirectory = "burp"; PrivateTmp = true; PrivateDevices = true; ProtectSystem = true; ProtectHome = true; NoNewPrivileges = true; ReadWriteDirectories = [ cfg.server.dataDirectory serverHome ]; ExecStartPre = "+${preStartScript}"; Nice = 19; IOSchedulingClass = "idle"; CPUSchedulingPolicy = "idle"; }; }; }; }