This repository has no description
2configs/sigexec: split executor/dashboard, add executors on starkstrom, coaxmetal, icarus, shodan
author
lassulus
date
(Sep 1, 2026, 6:16 PM CEST)
commit
871b865b
871b865bbc2acb7e884271dce86b1f2dd670031e
parent
14d07c2a
14d07c2aaf35fc9cc922dac22555d249e60043c4
+114
-63
-61
2configs/sigexec.nix
-61
2configs/sigexec.nix
···
1
-
# sigexec: signed remote command execution as root, for administration.
2
-
# The signature is the authorization — commands are signed in the browser
3
-
# (passkey) or by the CLI's local ed25519 key, verified against the key list
4
-
# below; no shell parses them, argv runs literally.
5
-
#
6
-
# nginx terminates TLS and serves the dashboard (page + reverse proxy, no key
7
-
# material, no job data); the executor is localhost-only behind it.
8
-
# browser: https://sigexec.lassul.us (register passkeys at /register)
9
-
# CLI: sigexec run -x https://sigexec.lassul.us/x/neoprism -- uptime
10
-
# (statements sign the path relative to the base URL, so the executor
11
-
# verifies /jobs after the proxy strips /x/neoprism)
12
-
let
13
-
domain = "sigexec.lassul.us";
14
-
executorPort = 7601;
15
-
dashboardPort = 7501;
16
-
in
17
-
{ self, ... }:
18
-
{
19
-
imports = [ self.inputs.sigexec.nixosModules.default ];
20
-
21
-
services.sigexec-executor = {
22
-
enable = true;
23
-
# root deliberately: this executor's purpose is administration, and the
24
-
# executor's privileges are the jobs' privileges.
25
-
user = "root";
26
-
group = "root";
27
-
# ssh-style: login shell env, bare command names work.
28
-
login = true;
29
-
listen = "127.0.0.1:${toString executorPort}";
30
-
# Browser passkeys sign against the dashboard's origin.
31
-
rpId = domain;
32
-
origins = [ "https://${domain}" ];
33
-
authorizedKeys = [
34
-
"ed25519 RhYj8TzT8w3q50Oi3-q7U1KLRLrm66FltogC15ootJg read,request lass@ignavia"
35
-
"webauthn-es256 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZPkoTMJKVdsC-_m8wPrKrJiCKVcZLdJarMTzF8JQFJUKmYlqY_34oQr1u9wCMTQZFU541Jmje1ri9z20XmsXpQ 6KpUo9EZQrmOCQ0vVwgnbw read,write lass@ignavia"
36
-
];
37
-
};
38
-
39
-
services.sigexec-dashboard = {
40
-
enable = true;
41
-
rpId = domain;
42
-
port = dashboardPort;
43
-
executors.neoprism = "http://127.0.0.1:${toString executorPort}";
44
-
};
45
-
46
-
services.nginx.virtualHosts.${domain} = {
47
-
enableACME = true;
48
-
forceSSL = true;
49
-
locations."/" = {
50
-
proxyPass = "http://127.0.0.1:${toString dashboardPort}";
51
-
extraConfig = ''
52
-
# Job streams are long-lived chunked responses: unbuffered so output
53
-
# arrives live, and a generous read timeout because `logs` on a
54
-
# pending job legitimately blocks until someone approves it.
55
-
proxy_buffering off;
56
-
proxy_read_timeout 1d;
57
-
proxy_send_timeout 1d;
58
-
'';
59
-
};
60
-
};
61
-
}
+51
2configs/sigexec/dashboard.nix
+51
2configs/sigexec/dashboard.nix
···
1
+
# sigexec dashboard: one page + executor registry + reverse proxy (no key
2
+
# material, no job data). nginx terminates TLS and forwards to it; the
3
+
# executors themselves live in ./executor.nix on each machine.
4
+
# browser: https://sigexec.lassul.us (register passkeys at /register)
5
+
# CLI: sigexec run -x https://sigexec.lassul.us/x/neoprism -- uptime
6
+
# (statements sign the path relative to the base URL, so the executor
7
+
# verifies /jobs after the proxy strips /x/neoprism)
8
+
let
9
+
domain = "sigexec.lassul.us";
10
+
dashboardPort = 7501;
11
+
# Must match 2configs/sigexec/executor.nix.
12
+
executorPort = 7601;
13
+
in
14
+
{ self, ... }:
15
+
{
16
+
imports = [ self.inputs.sigexec.nixosModules.dashboard ];
17
+
18
+
services.sigexec-dashboard = {
19
+
enable = true;
20
+
rpId = domain;
21
+
port = dashboardPort;
22
+
executors = {
23
+
# this host's own executor (neoprism also imports ./executor.nix)
24
+
neoprism = "http://127.0.0.1:${toString executorPort}";
25
+
# reached over retiolum (executor port is open on that interface only)
26
+
coaxmetal = "http://coaxmetal.r:${toString executorPort}";
27
+
icarus = "http://icarus.r:${toString executorPort}";
28
+
shodan = "http://shodan.r:${toString executorPort}";
29
+
# starkstrom is not in the shared kartei registry yet, so the fleet has
30
+
# no retiolum route to it; its own nginx terminates TLS and strips the
31
+
# /sigexec prefix (machines/starkstrom/config.nix).
32
+
starkstrom = "https://starkstrom.lassul.us/sigexec";
33
+
};
34
+
};
35
+
36
+
services.nginx.virtualHosts.${domain} = {
37
+
enableACME = true;
38
+
forceSSL = true;
39
+
locations."/" = {
40
+
proxyPass = "http://127.0.0.1:${toString dashboardPort}";
41
+
extraConfig = ''
42
+
# Job streams are long-lived chunked responses: unbuffered so output
43
+
# arrives live, and a generous read timeout because `logs` on a
44
+
# pending job legitimately blocks until someone approves it.
45
+
proxy_buffering off;
46
+
proxy_read_timeout 1d;
47
+
proxy_send_timeout 1d;
48
+
'';
49
+
};
50
+
};
51
+
}
+40
2configs/sigexec/executor.nix
+40
2configs/sigexec/executor.nix
···
1
+
# sigexec executor: signed remote command execution as root, for
2
+
# administration. The signature is the authorization — commands are signed in
3
+
# the browser (passkey) or by the CLI's local ed25519 key, verified against
4
+
# the key list below; no shell parses them, argv runs literally.
5
+
#
6
+
# There is no TLS here: the port is opened on retiolum only, and the dashboard
7
+
# on neoprism (./dashboard.nix) proxies browser/CLI traffic to it. Machines
8
+
# not reachable over retiolum (starkstrom) additionally put their own nginx in
9
+
# front; see machines/starkstrom/config.nix.
10
+
let
11
+
# Must match the executor URLs registered in ./dashboard.nix.
12
+
executorPort = 7601;
13
+
domain = "sigexec.lassul.us";
14
+
in
15
+
{ self, ... }:
16
+
{
17
+
imports = [ self.inputs.sigexec.nixosModules.executor ];
18
+
19
+
services.sigexec-executor = {
20
+
enable = true;
21
+
# root deliberately: this executor's purpose is administration, and the
22
+
# executor's privileges are the jobs' privileges.
23
+
user = "root";
24
+
group = "root";
25
+
# ssh-style: login shell env, bare command names work.
26
+
login = true;
27
+
# Wildcard dual-stack bind; reachability is the firewall's job below.
28
+
listen = "[::]:${toString executorPort}";
29
+
# Browser passkeys sign against the dashboard's origin.
30
+
rpId = domain;
31
+
origins = [ "https://${domain}" ];
32
+
authorizedKeys = [
33
+
"ed25519 RhYj8TzT8w3q50Oi3-q7U1KLRLrm66FltogC15ootJg read,request lass@ignavia"
34
+
"webauthn-es256 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZPkoTMJKVdsC-_m8wPrKrJiCKVcZLdJarMTzF8JQFJUKmYlqY_34oQr1u9wCMTQZFU541Jmje1ri9z20XmsXpQ 6KpUo9EZQrmOCQ0vVwgnbw read,write lass@ignavia"
35
+
];
36
+
};
37
+
38
+
# Reachable from the mesh only; the dashboard proxies for the outside world.
39
+
networking.firewall.interfaces.retiolum.allowedTCPPorts = [ executorPort ];
40
+
}
+1
machines/coaxmetal/config.nix
+1
machines/coaxmetal/config.nix
+1
machines/icarus/config.nix
+1
machines/icarus/config.nix
+4
-2
machines/neoprism/config.nix
+4
-2
machines/neoprism/config.nix
···
121
121
# self-hosted iroh relay (relay.lassul.us)
122
122
../../2configs/iroh-relay
123
123
124
-
# signed remote command execution (root executor, sigexec.lassul.us)
125
-
../../2configs/sigexec.nix
124
+
# signed remote command execution (root executor + fleet dashboard,
125
+
# sigexec.lassul.us)
126
+
../../2configs/sigexec/executor.nix
127
+
../../2configs/sigexec/dashboard.nix
126
128
];
127
129
128
130
# lassul.us shouldn't be the default vhost here (nginx.nix already sets one)
+1
machines/shodan/config.nix
+1
machines/shodan/config.nix
+16
machines/starkstrom/config.nix
+16
machines/starkstrom/config.nix
···
5
5
../../2configs/retiolum.nix
6
6
../../2configs/ssh-redirect.nix
7
7
../../2configs/autoupdate.nix
8
+
../../2configs/sigexec/executor.nix
8
9
./ipfs.nix
9
10
./ipfs-endpoint.nix
10
11
];
···
34
35
};
35
36
36
37
krebs.build.host = config.krebs.hosts.starkstrom;
38
+
39
+
# The fleet has no retiolum route here (see kartei note above), so the
40
+
# sigexec dashboard on neoprism reaches this executor over public TLS
41
+
# instead: nginx strips /sigexec/ so the executor verifies the same paths
42
+
# the statements were signed over (/jobs etc).
43
+
services.nginx.virtualHosts."starkstrom.lassul.us".locations."/sigexec/" = {
44
+
proxyPass = "http://127.0.0.1:7601/";
45
+
extraConfig = ''
46
+
# Long-lived chunked job streams: unbuffered, generous timeouts (logs on
47
+
# a pending job blocks until approval).
48
+
proxy_buffering off;
49
+
proxy_read_timeout 1d;
50
+
proxy_send_timeout 1d;
51
+
'';
52
+
};
37
53
38
54
system.stateVersion = "25.11";
39
55
}