This repository has no description
neoprism: add sigexec executor (root, behind sigexec.lassul.us)
author
lassulus
date
(Sep 1, 2026, 6:16 PM CEST)
commit
caa7442c
caa7442cc5af68a00f9e454d07393b3622b7afbf
parent
c695379a
c695379a0fa8de8b97a29d3dffe3a51b1e03f8e8
+72
+21
flake.lock
+21
flake.lock
···
864
864
"nixvim": "nixvim",
865
865
"opencrow": "opencrow",
866
866
"rogue-talk": "rogue-talk",
867
+
"sigexec": "sigexec",
867
868
"spora": "spora",
868
869
"stockholm": "stockholm",
869
870
"treefmt-nix": "treefmt-nix_7",
870
871
"wrappers": "wrappers"
872
+
}
873
+
},
874
+
"sigexec": {
875
+
"inputs": {
876
+
"nixpkgs": [
877
+
"nixpkgs"
878
+
]
879
+
},
880
+
"locked": {
881
+
"lastModified": 1788186522,
882
+
"narHash": "sha256-7x/POjkcNG9tbaAg6zl+jC4MFVWB25BoyXBS1ffeOVM=",
883
+
"ref": "refs/heads/main",
884
+
"rev": "6b7a2f004fd46cd78a65c90dfdb1fb4657939afe",
885
+
"revCount": 4,
886
+
"type": "git",
887
+
"url": "https://git.geninf.io/Lassulus/sigexec"
888
+
},
889
+
"original": {
890
+
"type": "git",
891
+
"url": "https://git.geninf.io/Lassulus/sigexec"
871
892
}
872
893
},
873
894
"sops-nix": {
+3
flake.nix
+3
flake.nix
+45
2configs/sigexec.nix
+45
2configs/sigexec.nix
···
1
+
# sigexec executor: signed remote command execution as root, for
2
+
# administration. The signature is the authorization — commands are signed
3
+
# with the CLI's local ed25519 key (or a passkey) and verified against the
4
+
# key list below; no shell parses them, argv runs literally.
5
+
#
6
+
# The executor itself has no TLS and listens on localhost; nginx terminates
7
+
# TLS on the public vhost: sigexec run -x https://sigexec.lassul.us -- uptime
8
+
let
9
+
domain = "sigexec.lassul.us";
10
+
port = 7601;
11
+
in
12
+
{ self, ... }:
13
+
{
14
+
imports = [ self.inputs.sigexec.nixosModules.executor ];
15
+
16
+
services.sigexec-executor = {
17
+
enable = true;
18
+
# root deliberately: this executor's purpose is administration, and the
19
+
# executor's privileges are the jobs' privileges.
20
+
user = "root";
21
+
group = "root";
22
+
# ssh-style: login shell env, bare command names work.
23
+
login = true;
24
+
listen = "127.0.0.1:${toString port}";
25
+
authorizedKeys = [
26
+
"ed25519 RhYj8TzT8w3q50Oi3-q7U1KLRLrm66FltogC15ootJg read,write lass@ignavia"
27
+
];
28
+
};
29
+
30
+
services.nginx.virtualHosts.${domain} = {
31
+
enableACME = true;
32
+
forceSSL = true;
33
+
locations."/" = {
34
+
proxyPass = "http://127.0.0.1:${toString port}";
35
+
extraConfig = ''
36
+
# Job streams are long-lived chunked responses: unbuffered so output
37
+
# arrives live, and a generous read timeout because `logs` on a
38
+
# pending job legitimately blocks until someone approves it.
39
+
proxy_buffering off;
40
+
proxy_read_timeout 1d;
41
+
proxy_send_timeout 1d;
42
+
'';
43
+
};
44
+
};
45
+
}
+3
machines/neoprism/config.nix
+3
machines/neoprism/config.nix
···
120
120
121
121
# self-hosted iroh relay (relay.lassul.us)
122
122
../../2configs/iroh-relay
123
+
124
+
# signed remote command execution (root executor, sigexec.lassul.us)
125
+
../../2configs/sigexec.nix
123
126
];
124
127
125
128
# lassul.us shouldn't be the default vhost here (nginx.nix already sets one)