-21

flake.lock

View file Reviewed

··· 687 687 "nixpkgs": "nixpkgs_2", 688 688 "nixpkgs-triage": "nixpkgs-triage", 689 689 "nixvim": "nixvim", 690 690 - "sigexec": "sigexec", 691 690 "tincr": "tincr", 692 691 "treefmt-nix": "treefmt-nix_4", 693 692 "wrappers": "wrappers" ··· 708 707 "ref": "nightly", 709 708 "repo": "rust-analyzer", 710 709 "type": "github" 711 711 - } 712 712 - }, 713 713 - "sigexec": { 714 714 - "inputs": { 715 715 - "nixpkgs": [ 716 716 - "nixpkgs" 717 717 - ] 718 718 - }, 719 719 - "locked": { 720 720 - "lastModified": 1788191050, 721 721 - "narHash": "sha256-FtnWlJGst6P8w7EfeHF8gwn52oK0sbavMOy/2SeJKNU=", 722 722 - "ref": "refs/heads/main", 723 723 - "rev": "44504b02ca230c865d474275b16f8a831081dd4b", 724 724 - "revCount": 6, 725 725 - "type": "git", 726 726 - "url": "https://git.geninf.io/Lassulus/sigexec" 727 727 - }, 728 728 - "original": { 729 729 - "type": "git", 730 730 - "url": "https://git.geninf.io/Lassulus/sigexec" 731 710 } 732 711 }, 733 712 "sops-nix": {

-3

flake.nix

View file Reviewed

··· 71 71 nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver"; 72 72 nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs"; 73 73 74 74 - sigexec.url = "git+https://git.geninf.io/Lassulus/sigexec"; 75 75 - sigexec.inputs.nixpkgs.follows = "nixpkgs"; 76 76 - 77 74 # build farm (configs/nix-farm): remote builds over grpc:// ... 78 75 # Fork with the drain/upload race fix (Mic92/nix-grpc-store#204); 79 76 # back to upstream once that is merged.

-51

configs/sigexec/dashboard.nix

Reviewed

··· 1 1 - # sigexec dashboard: one page + executor registry + reverse proxy (no key 2 2 - # material, no job data). nginx terminates TLS and forwards to it; the 3 3 - # executors themselves live in ./executor.nix on each machine. 4 4 - # browser: https://sigexec.lassul.us (register passkeys at /register) 5 5 - # CLI: sigexec run -x https://sigexec.lassul.us/x/neoprism -- uptime 6 6 - # (statements sign the path relative to the base URL, so the executor 7 7 - # verifies /jobs after the proxy strips /x/neoprism) 8 8 - let 9 9 - domain = "sigexec.lassul.us"; 10 10 - dashboardPort = 7501; 11 11 - # Must match configs/sigexec/executor.nix. 12 12 - executorPort = 7601; 13 13 - in 14 14 - { self, ... }: 15 15 - { 16 16 - imports = [ self.inputs.sigexec.nixosModules.dashboard ]; 17 17 - 18 18 - services.sigexec-dashboard = { 19 19 - enable = true; 20 20 - rpId = domain; 21 21 - port = dashboardPort; 22 22 - executors = { 23 23 - # this host's own executor (neoprism also imports ./executor.nix) 24 24 - neoprism = "http://127.0.0.1:${toString executorPort}"; 25 25 - # reached over retiolum (executor port is open on that interface only) 26 26 - coaxmetal = "http://coaxmetal.r:${toString executorPort}"; 27 27 - icarus = "http://icarus.r:${toString executorPort}"; 28 28 - shodan = "http://shodan.r:${toString executorPort}"; 29 29 - # over public TLS (set up before starkstrom had a kartei card); its own 30 30 - # nginx terminates TLS and strips the /sigexec prefix 31 31 - # (machines/starkstrom/config.nix). 32 32 - starkstrom = "https://starkstrom.lassul.us/sigexec"; 33 33 - }; 34 34 - }; 35 35 - 36 36 - services.nginx.virtualHosts.${domain} = { 37 37 - enableACME = true; 38 38 - forceSSL = true; 39 39 - locations."/" = { 40 40 - proxyPass = "http://127.0.0.1:${toString dashboardPort}"; 41 41 - extraConfig = '' 42 42 - # Job streams are long-lived chunked responses: unbuffered so output 43 43 - # arrives live, and a generous read timeout because `logs` on a 44 44 - # pending job legitimately blocks until someone approves it. 45 45 - proxy_buffering off; 46 46 - proxy_read_timeout 1d; 47 47 - proxy_send_timeout 1d; 48 48 - ''; 49 49 - }; 50 50 - }; 51 51 - }

-40

configs/sigexec/executor.nix

Reviewed

··· 1 1 - # sigexec executor: signed remote command execution as root, for 2 2 - # administration. The signature is the authorization — commands are signed in 3 3 - # the browser (passkey) or by the CLI's local ed25519 key, verified against 4 4 - # the key list below; no shell parses them, argv runs literally. 5 5 - # 6 6 - # There is no TLS here: the port is opened on retiolum only, and the dashboard 7 7 - # on neoprism (./dashboard.nix) proxies browser/CLI traffic to it. Machines 8 8 - # not reachable over retiolum (starkstrom) additionally put their own nginx in 9 9 - # front; see machines/starkstrom/config.nix. 10 10 - let 11 11 - # Must match the executor URLs registered in ./dashboard.nix. 12 12 - executorPort = 7601; 13 13 - domain = "sigexec.lassul.us"; 14 14 - in 15 15 - { self, ... }: 16 16 - { 17 17 - imports = [ self.inputs.sigexec.nixosModules.executor ]; 18 18 - 19 19 - services.sigexec-executor = { 20 20 - enable = true; 21 21 - # root deliberately: this executor's purpose is administration, and the 22 22 - # executor's privileges are the jobs' privileges. 23 23 - user = "root"; 24 24 - group = "root"; 25 25 - # ssh-style: login shell env, bare command names work. 26 26 - login = true; 27 27 - # Wildcard dual-stack bind; reachability is the firewall's job below. 28 28 - listen = "[::]:${toString executorPort}"; 29 29 - # Browser passkeys sign against the dashboard's origin. 30 30 - rpId = domain; 31 31 - origins = [ "https://${domain}" ]; 32 32 - authorizedKeys = [ 33 33 - "ed25519 RhYj8TzT8w3q50Oi3-q7U1KLRLrm66FltogC15ootJg read,request lass@ignavia" 34 34 - "webauthn-es256 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZPkoTMJKVdsC-_m8wPrKrJiCKVcZLdJarMTzF8JQFJUKmYlqY_34oQr1u9wCMTQZFU541Jmje1ri9z20XmsXpQ 6KpUo9EZQrmOCQ0vVwgnbw read,write lass@ignavia" 35 35 - ]; 36 36 - }; 37 37 - 38 38 - # Reachable from the mesh only; the dashboard proxies for the outside world. 39 39 - networking.firewall.interfaces.retiolum.allowedTCPPorts = [ executorPort ]; 40 40 - }

-1

machines/coaxmetal/config.nix

View file Reviewed

··· 15 15 ../../configs/steam.nix 16 16 ../../configs/wine.nix 17 17 ../../configs/review.nix 18 18 - ../../configs/sigexec/executor.nix 19 18 ../../configs/rad.nix 20 19 ../../configs/orca/ide.nix 21 20 ../../configs/orca/server.nix

-1

machines/icarus/config.nix

View file Reviewed

··· 12 12 ../../configs/snapclient.nix 13 13 ../../configs/gg23/audio/room.nix 14 14 ../../configs/autoupdate.nix 15 15 - ../../configs/sigexec/executor.nix 16 15 ../../configs/rad.nix 17 16 ../../configs/phonetpm-ssh.nix 18 17 ];

-5

machines/neoprism/config.nix

View file Reviewed

··· 111 111 # self-hosted iroh relay (relay.lassul.us) 112 112 ../../configs/iroh-relay 113 113 114 114 - # signed remote command execution (root executor + fleet dashboard, 115 115 - # sigexec.lassul.us) 116 116 - ../../configs/sigexec/executor.nix 117 117 - ../../configs/sigexec/dashboard.nix 118 118 - 119 114 # parley federated IRC-speaking chat (parley.lassul.us) 120 115 ../../configs/parley.nix 121 116

-1

machines/shodan/config.nix

View file Reviewed

··· 9 9 ../../configs/network-manager.nix 10 10 ../../configs/snapclient.nix 11 11 ../../configs/gg23/audio/room.nix 12 12 - ../../configs/sigexec/executor.nix 13 12 ../../configs/rad.nix 14 13 ../../configs/phonetpm-ssh.nix 15 14 ];

-16

machines/starkstrom/config.nix

View file Reviewed

··· 4 4 ../../configs/retiolum.nix 5 5 ../../configs/ssh-redirect.nix 6 6 ../../configs/autoupdate.nix 7 7 - ../../configs/sigexec/executor.nix 8 7 ./ipfs.nix 9 8 ./ipfs-endpoint.nix 10 9 ]; 11 11 - 12 12 - # The sigexec dashboard on neoprism reaches this executor over public TLS 13 13 - # (set up before starkstrom had a kartei card; starkstrom.r would work now): 14 14 - # nginx strips /sigexec/ so the executor verifies the same paths the 15 15 - # statements were signed over (/jobs etc). 16 16 - services.nginx.virtualHosts."starkstrom.lassul.us".locations."/sigexec/" = { 17 17 - proxyPass = "http://127.0.0.1:7601/"; 18 18 - extraConfig = '' 19 19 - # Long-lived chunked job streams: unbuffered, generous timeouts (logs on 20 20 - # a pending job blocks until approval). 21 21 - proxy_buffering off; 22 22 - proxy_read_timeout 1d; 23 23 - proxy_send_timeout 1d; 24 24 - ''; 25 25 - }; 26 10 27 11 system.stateVersion = "25.11"; 28 12 }