This repository has no description
neoprism: put the sigexec dashboard in front of the executor
author
lassulus
date
(Sep 1, 2026, 6:16 PM CEST)
commit
02617db4
02617db4b1c2058cbd07151352fd4871a7db6478
parent
caa7442c
caa7442cc5af68a00f9e454d07393b3622b7afbf
+25
-10
+25
-10
2configs/sigexec.nix
+25
-10
2configs/sigexec.nix
···
1
-
# sigexec executor: signed remote command execution as root, for
2
-
# administration. The signature is the authorization — commands are signed
3
-
# with the CLI's local ed25519 key (or a passkey) and verified against the
4
-
# key list below; no shell parses them, argv runs literally.
1
+
# sigexec: signed remote command execution as root, for administration.
2
+
# The signature is the authorization — commands are signed in the browser
3
+
# (passkey) or by the CLI's local ed25519 key, verified against the key list
4
+
# below; no shell parses them, argv runs literally.
5
5
#
6
-
# The executor itself has no TLS and listens on localhost; nginx terminates
7
-
# TLS on the public vhost: sigexec run -x https://sigexec.lassul.us -- uptime
6
+
# nginx terminates TLS and serves the dashboard (page + reverse proxy, no key
7
+
# material, no job data); the executor is localhost-only behind it.
8
+
# browser: https://sigexec.lassul.us (register passkeys at /register)
9
+
# CLI: sigexec run -x https://sigexec.lassul.us/x/neoprism -- uptime
10
+
# (statements sign the path relative to the base URL, so the executor
11
+
# verifies /jobs after the proxy strips /x/neoprism)
8
12
let
9
13
domain = "sigexec.lassul.us";
10
-
port = 7601;
14
+
executorPort = 7601;
15
+
dashboardPort = 7501;
11
16
in
12
17
{ self, ... }:
13
18
{
14
-
imports = [ self.inputs.sigexec.nixosModules.executor ];
19
+
imports = [ self.inputs.sigexec.nixosModules.default ];
15
20
16
21
services.sigexec-executor = {
17
22
enable = true;
···
21
26
group = "root";
22
27
# ssh-style: login shell env, bare command names work.
23
28
login = true;
24
-
listen = "127.0.0.1:${toString port}";
29
+
listen = "127.0.0.1:${toString executorPort}";
30
+
# Browser passkeys sign against the dashboard's origin.
31
+
rpId = domain;
32
+
origins = [ "https://${domain}" ];
25
33
authorizedKeys = [
26
34
"ed25519 RhYj8TzT8w3q50Oi3-q7U1KLRLrm66FltogC15ootJg read,write lass@ignavia"
27
35
];
36
+
};
37
+
38
+
services.sigexec-dashboard = {
39
+
enable = true;
40
+
rpId = domain;
41
+
port = dashboardPort;
42
+
executors.neoprism = "http://127.0.0.1:${toString executorPort}";
28
43
};
29
44
30
45
services.nginx.virtualHosts.${domain} = {
31
46
enableACME = true;
32
47
forceSSL = true;
33
48
locations."/" = {
34
-
proxyPass = "http://127.0.0.1:${toString port}";
49
+
proxyPass = "http://127.0.0.1:${toString dashboardPort}";
35
50
extraConfig = ''
36
51
# Job streams are long-lived chunked responses: unbuffered so output
37
52
# arrives live, and a generous read timeout because `logs` on a