From a536b2a1d66627c3abf476aea31ee894d443a581 Mon Sep 17 00:00:00 2001 From: Patrick Date: Sun, 10 Aug 2025 18:14:12 +0200 Subject: [PATCH] firezone-server: 0-unstable-2025-03-15 -> 0-unstable-2025-08-10 --- .../manual/release-notes/rl-2511.section.md | 2 + .../networking/firezone/provision.exs | 2 +- .../services/networking/firezone/server.nix | 5 +- nixos/tests/firezone/firezone.nix | 63 +++++++++++++++---- .../fi/firezone-server/0000-add-mua.patch | 47 ++++---------- pkgs/by-name/fi/firezone-server/package.nix | 10 +-- 6 files changed, 76 insertions(+), 53 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index eea249615495..2049e546f76c 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -169,6 +169,8 @@ - `i18n.inputMethod.fcitx5.plasma6Support` has been removed because qt6 is the only one used for fcitx5-configtool now. +- `firezone` has changed how the `Everyone` group behaves. Service Accounts are no longer considered part of `Everyone`. + - The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option. - The Postfix module has been updated and likely requires configuration changes: diff --git a/nixos/modules/services/networking/firezone/provision.exs b/nixos/modules/services/networking/firezone/provision.exs index d8e60d32cf32..9651140525e2 100644 --- a/nixos/modules/services/networking/firezone/provision.exs +++ b/nixos/modules/services/networking/firezone/provision.exs @@ -343,7 +343,7 @@ defmodule Provision do case Map.get(changes, {:account, slug}) do {:new, account} -> Logger.info("Creating everyone group for new account") - {:ok, actor_group} = Actors.create_managed_group(account, %{name: "Everyone", membership_rules: [%{operator: true}]}) + {:ok, actor_group} = Actors.create_managed_group(account, %{name: "Everyone"}) UuidMapping.update_entities(slug, "actor_groups", %{"everyone" => actor_group.id}) {:ok, actor_group} {:existing, _account} -> diff --git a/nixos/modules/services/networking/firezone/server.nix b/nixos/modules/services/networking/firezone/server.nix index 3206d1d30e76..09d22feb6d8d 100644 --- a/nixos/modules/services/networking/firezone/server.nix +++ b/nixos/modules/services/networking/firezone/server.nix @@ -546,7 +546,6 @@ in }; in { - flow_activities = mkFeatureOption "flow_activities" true; policy_conditions = mkFeatureOption "policy_conditions" true; multi_site_resources = mkFeatureOption "multi_site_resources" true; traffic_filters = mkFeatureOption "traffic_filters" true; @@ -923,9 +922,13 @@ in { name = "firezone"; ensureDBOwnership = true; + ensureClauses.superuser = true; } ]; ensureDatabases = [ "firezone" ]; + # Firezone uses an internal replication strategy + # that depends on a logical wal + settings.wal_level = "logical"; }; services.firezone.server.settings = { diff --git a/nixos/tests/firezone/firezone.nix b/nixos/tests/firezone/firezone.nix index 82b05b47086c..37612395e468 100644 --- a/nixos/tests/firezone/firezone.nix +++ b/nixos/tests/firezone/firezone.nix @@ -5,7 +5,10 @@ let in { name = "firezone"; - meta.maintainers = with pkgs.lib.maintainers; [ oddlama ]; + meta.maintainers = with pkgs.lib.maintainers; [ + oddlama + patrickdag + ]; nodes = { server = @@ -18,6 +21,21 @@ in { security.pki.certificateFiles = [ certs.ca.cert ]; + # To debug problems: + # 1. comment this in + # 2. cat '127.0.0.1 acme.test` >> /etc/hosts + # 3. socat TCP-LISTEN:443,fork TCP:127.0.0.1:12345 + # 4. Firezone has to succeed when sending mail + # - Get opensmtpd to work + # - add an actual mailaccount to the test + # virtualisation.forwardPorts = [ + # { + # from = "host"; + # host.port = 12345; + # guest.port = 443; + # } + # ]; + networking.extraHosts = '' ${config.networking.primaryIPAddress} ${domain} ${config.networking.primaryIPv6Address} ${domain} @@ -36,6 +54,20 @@ in }; }; + # This doesn't actually work firezone/Swoosh seems to send 2 `EHLO` + # which opensmtpd does not allow + # https://github.com/OpenSMTPD/OpenSMTPD/issues/1284 + # Would be nice for debbuging + # services.opensmtpd = { + # enable = true; + # extraServerArgs = [ "-v" ]; + # serverConfiguration = '' + # listen on 0.0.0.0 + # action "local" maildir "/tmp/maildir" + # match for domain "localhost.localdomain" action "local" + # ''; + # }; + services.firezone.server = { enable = true; enableLocalDB = true; @@ -44,12 +76,12 @@ in # Doesn't need to work for this test, but needs to be configured # otherwise the server will not start. smtp = { - from = "firezone@example.com"; - host = "mail.localhost"; - port = 465; - implicitTls = true; - username = "firezone@example.com"; - passwordFile = pkgs.writeText "tmpmailpasswd" "supermailpassword"; + from = "firezone@localhost.localdomain"; + host = "localhost"; + port = 25; + implicitTls = false; + username = "firezone@localhost.localdomain"; + passwordFile = pkgs.writeText "tmpmailpasswd" "verysecurepassword"; }; provision = { @@ -62,7 +94,7 @@ in admin = { type = "account_admin_user"; name = "Admin"; - email = "admin@example.com"; + email = "admin@localhost.localdomain"; }; client = { type = "service_account"; @@ -70,6 +102,14 @@ in email = "client@example.com"; }; }; + # service accounts aren't members of 'Everyone' so we need to add a separate group + groups.main = { + name = "main"; + members = [ + "client" + "admin" + ]; + }; resources.res1 = { type = "dns"; name = "Dns Resource"; @@ -97,17 +137,17 @@ in }; policies.pol1 = { description = "Allow anyone res1 access"; - group = "everyone"; + group = "main"; resource = "res1"; }; policies.pol2 = { description = "Allow anyone res2 access"; - group = "everyone"; + group = "main"; resource = "res2"; }; policies.pol3 = { description = "Allow anyone res3 access"; - group = "everyone"; + group = "main"; resource = "res3"; }; }; @@ -334,7 +374,6 @@ in with subtest("Check DNS based access"): # Check that we can access the resource through the VPN via DNS client.wait_until_succeeds("curl -4 -Lsf http://resource.example.com | grep 'greetings from the resource'") - client.wait_until_succeeds("curl -6 -Lsf http://resource.example.com | grep 'greetings from the resource'") with subtest("Check CIDR based access"): # Check that we can access the resource through the VPN via CIDR diff --git a/pkgs/by-name/fi/firezone-server/0000-add-mua.patch b/pkgs/by-name/fi/firezone-server/0000-add-mua.patch index 68d8a9ba47ab..cee9e1ef64fc 100644 --- a/pkgs/by-name/fi/firezone-server/0000-add-mua.patch +++ b/pkgs/by-name/fi/firezone-server/0000-add-mua.patch @@ -1,8 +1,8 @@ diff --git a/elixir/apps/domain/lib/domain/config/definitions.ex b/elixir/apps/domain/lib/domain/config/definitions.ex -index 8cd2e8d0f..92e18b10b 100644 +index 3bf383eac..ed0521045 100644 --- a/elixir/apps/domain/lib/domain/config/definitions.ex +++ b/elixir/apps/domain/lib/domain/config/definitions.ex -@@ -584,6 +590,7 @@ defmodule Domain.Config.Definitions do +@@ -619,6 +619,7 @@ defmodule Domain.Config.Definitions do Swoosh.Adapters.Mailgun, Swoosh.Adapters.Mailjet, Swoosh.Adapters.Mandrill, @@ -10,33 +10,11 @@ index 8cd2e8d0f..92e18b10b 100644 Swoosh.Adapters.Postmark, Swoosh.Adapters.ProtonBridge, Swoosh.Adapters.SMTP, -diff --git a/elixir/config/runtime.exs b/elixir/config/runtime.exs -index 15037e0a3..475c4ddfb 100644 ---- a/elixir/config/runtime.exs -+++ b/elixir/config/runtime.exs -@@ -226,8 +228,15 @@ if config_env() == :prod do - config :domain, - Domain.Mailer, - [ -- adapter: compile_config!(:outbound_email_adapter), -- from_email: compile_config!(:outbound_email_from) -+ adapter: compile_config!(:outbound_email_adapter), -+ from_email: compile_config!(:outbound_email_from), -+ protocol: String.to_atom(System.get_env("OUTBOUND_EMAIL_SMTP_PROTOCOL")), -+ relay: System.get_env("OUTBOUND_EMAIL_SMTP_HOST"), -+ port: String.to_integer(System.get_env("OUTBOUND_EMAIL_SMTP_PORT")), -+ auth: [ -+ username: System.get_env("OUTBOUND_EMAIL_SMTP_USERNAME"), -+ password: System.get_env("OUTBOUND_EMAIL_SMTP_PASSWORD") -+ ] - ] ++ compile_config!(:outbound_email_adapter_opts) - - config :workos, WorkOS.Client, diff --git a/elixir/mix.exs b/elixir/mix.exs -index 12782d631..dee1245d2 100644 +index df90739df..5c53e4383 100644 --- a/elixir/mix.exs +++ b/elixir/mix.exs -@@ -47,7 +47,9 @@ defmodule Firezone.MixProject do +@@ -50,7 +50,9 @@ defmodule Firezone.MixProject do # Formatter doesn't track dependencies of children applications {:phoenix, "~> 1.7.0"}, {:phoenix_live_view, "~> 1.0.0-rc.0"}, @@ -48,20 +26,21 @@ index 12782d631..dee1245d2 100644 end diff --git a/elixir/mix.lock b/elixir/mix.lock -index 8c4b65959..3d2f9faca 100644 +index 0b03b58d0..eefb202f4 100644 --- a/elixir/mix.lock +++ b/elixir/mix.lock -@@ -50,11 +50,13 @@ +@@ -49,11 +49,13 @@ "junit_formatter": {:hex, :junit_formatter, "3.4.0", "d0e8db6c34dab6d3c4154c3b46b21540db1109ae709d6cf99ba7e7a2ce4b1ac2", [:mix], [], "hexpm", "bb36e2ae83f1ced6ab931c4ce51dd3dbef1ef61bb4932412e173b0cfa259dacd"}, - "libcluster": {:hex, :libcluster, "3.3.3", "a4f17721a19004cfc4467268e17cff8b1f951befe428975dd4f6f7b84d927fe0", [:mix], [{:jason, "~> 1.1", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "7c0a2275a0bb83c07acd17dab3c3bfb4897b145106750eeccc62d302e3bdfee5"}, - "logger_json": {:hex, :logger_json, "6.2.0", "13e2e9f5f7b195865c5c3ef3d296c3ad50e7ecb038d899433702a79e979b91d7", [:mix], [{:ecto, "~> 3.11", [hex: :ecto, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:plug, "~> 1.15", [hex: :plug, repo: "hexpm", optional: true]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: true]}], "hexpm", "98366d02bedbb56e41b25a6d248d566d4f4bc224bae2b1e982df00ed04ba9219"}, + "libcluster": {:hex, :libcluster, "3.5.0", "5ee4cfde4bdf32b2fef271e33ce3241e89509f4344f6c6a8d4069937484866ba", [:mix], [{:jason, "~> 1.1", [hex: :jason, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.3", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "ebf6561fcedd765a4cd43b4b8c04b1c87f4177b5fb3cbdfe40a780499d72f743"}, + "logger_json": {:hex, :logger_json, "7.0.4", "e315f2b9a755504658a745f3eab90d88d2cd7ac2ecfd08c8da94d8893965ab5c", [:mix], [{:decimal, ">= 0.0.0", [hex: :decimal, repo: "hexpm", optional: true]}, {:ecto, "~> 3.11", [hex: :ecto, repo: "hexpm", optional: true]}, {:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: true]}, {:plug, "~> 1.15", [hex: :plug, repo: "hexpm", optional: true]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: true]}], "hexpm", "d1369f8094e372db45d50672c3b91e8888bcd695fdc444a37a0734e96717c45c"}, + "mail": {:hex, :mail, "0.3.1", "cb0a14e4ed8904e4e5a08214e686ccf6f9099346885db17d8c309381f865cc5c", [:mix], [], "hexpm", "1db701e89865c1d5fa296b2b57b1cd587587cca8d8a1a22892b35ef5a8e352a6"}, "metrics": {:hex, :metrics, "1.0.1", "25f094dea2cda98213cecc3aeff09e940299d950904393b2a29d191c346a8486", [:rebar3], [], "hexpm", "69b09adddc4f74a40716ae54d140f93beb0fb8978d8636eaded0c31b6f099f16"}, - "mime": {:hex, :mime, "2.0.6", "8f18486773d9b15f95f4f4f1e39b710045fa1de891fada4516559967276e4dc2", [:mix], [], "hexpm", "c9945363a6b26d747389aac3643f8e0e09d30499a138ad64fe8fd1d13d9b153e"}, - "mimerl": {:hex, :mimerl, "1.3.0", "d0cd9fc04b9061f82490f6581e0128379830e78535e017f7780f37fea7545726", [:rebar3], [], "hexpm", "a1e15a50d1887217de95f0b9b0793e32853f7c258a5cd227650889b38839fe9d"}, + "mime": {:hex, :mime, "2.0.7", "b8d739037be7cd402aee1ba0306edfdef982687ee7e9859bee6198c1e7e2f128", [:mix], [], "hexpm", "6171188e399ee16023ffc5b76ce445eb6d9672e2e241d2df6050f3c771e80ccd"}, + "mimerl": {:hex, :mimerl, "1.4.0", "3882a5ca67fbbe7117ba8947f27643557adec38fa2307490c4c4207624cb213b", [:rebar3], [], "hexpm", "13af15f9f68c65884ecca3a3891d50a7b57d82152792f3e19d88650aa126b144"}, "mint": {:hex, :mint, "1.6.2", "af6d97a4051eee4f05b5500671d47c3a67dac7386045d87a904126fd4bbcea2e", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "5ee441dffc1892f1ae59127f74afe8fd82fda6587794278d924e4d90ea3d63f9"}, - "mix_audit": {:hex, :mix_audit, "2.1.4", "0a23d5b07350cdd69001c13882a4f5fb9f90fbd4cbf2ebc190a2ee0d187ea3e9", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "fd807653cc8c1cada2911129c7eb9e985e3cc76ebf26f4dd628bb25bbcaa7099"}, + "mix_audit": {:hex, :mix_audit, "2.1.5", "c0f77cee6b4ef9d97e37772359a187a166c7a1e0e08b50edf5bf6959dfe5a016", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "87f9298e21da32f697af535475860dc1d3617a010e0b418d2ec6142bc8b42d69"}, + "mua": {:hex, :mua, "0.2.4", "a9172ab0a1ac8732cf2699d739ceac3febcb9b4ffc540260ad2e32c0b6632af9", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}], "hexpm", "e7e4dacd5ad65f13e3542772e74a159c00bd2d5579e729e9bb72d2c73a266fb7"}, "multipart": {:hex, :multipart, "0.4.0", "634880a2148d4555d050963373d0e3bbb44a55b2badd87fa8623166172e9cda0", [:mix], [{:mime, "~> 1.2 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}], "hexpm", "3c5604bc2fb17b3137e5d2abdf5dacc2647e60c5cc6634b102cf1aef75a06f0a"}, - "nimble_csv": {:hex, :nimble_csv, "1.2.0", "4e26385d260c61eba9d4412c71cea34421f296d5353f914afe3f2e71cce97722", [:mix], [], "hexpm", "d0628117fcc2148178b034044c55359b26966c6eaa8e2ce15777be3bbc91b12a"}, + "nimble_csv": {:hex, :nimble_csv, "1.3.0", "b7f998dc62b222bce9596e46f028c7a5af04cb5dde6df2ea197c583227c54971", [:mix], [], "hexpm", "41ccdc18f7c8f8bb06e84164fc51635321e80d5a3b450761c4997d620925d619"}, "nimble_options": {:hex, :nimble_options, "1.1.1", "e3a492d54d85fc3fd7c5baf411d9d2852922f66e69476317787a7b2bb000a61b", [:mix], [], "hexpm", "821b2470ca9442c4b6984882fe9bb0389371b8ddec4d45a9504f00a66f650b44"}, + diff --git a/pkgs/by-name/fi/firezone-server/package.nix b/pkgs/by-name/fi/firezone-server/package.nix index d1f835531a88..706d21b353ab 100644 --- a/pkgs/by-name/fi/firezone-server/package.nix +++ b/pkgs/by-name/fi/firezone-server/package.nix @@ -14,14 +14,14 @@ beamPackages.mixRelease rec { pname = "firezone-server-${mixReleaseName}"; - version = "0-unstable-2025-03-15"; + version = "0-unstable-2025-08-31"; src = "${ fetchFromGitHub { owner = "firezone"; repo = "firezone"; - rev = "09fb5f927410503b0d6e7fc6cf6a2ba06cb5a281"; - hash = "sha256-1CZBFhOwX0DfXykPQ9tzn4tHg2tSnByXEPtlZleHK5k="; + rev = "f86719db19b848ab757995361032c1f2b7927d13"; + hash = "sha256-YvPxLEE6pdILrABWCZs7ebf6i3Inm1k/YkotZgI7A2k="; # This is necessary to allow sending mails via SMTP, as the default # SMTP adapter is current broken: https://github.com/swoosh/swoosh/issues/785 @@ -35,7 +35,7 @@ beamPackages.mixRelease rec { inherit pname version; src = "${src}/apps/web/assets"; fetcherVersion = 1; - hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A="; + hash = "sha256-40vtQIBhJNnzdxkAOVAcPN57IuD0IB6LFxGICo68AbQ="; }; pnpmRoot = "apps/web/assets"; @@ -70,7 +70,7 @@ beamPackages.mixRelease rec { mixFodDeps = beamPackages.fetchMixDeps { pname = "mix-deps-${pname}-${version}"; inherit src version; - hash = "sha256-2Y9u5+o8+RG+c8Z6V7Vex5K1odI7a/WYj5fC0xWbVRo="; + hash = "sha256-h3l7HK9dxNmkHWfJyCOCXmCvFOK+mZtmszhRv0zxqoo="; }; passthru.tests = {