From b8165b6bbaeee8735aa95e8c33d0c4e59626667a Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 30 Jan 2025 17:50:01 +0100 Subject: [PATCH 1/2] g3proxy: init at 1.10.4 g3proxy is an alternative forward proxy to squid or tinyproxy, written in Rust, relying on modern cryptography stacks like partially verified AWS LC and RustTLS. AWS LC library is vendored because of how the Rust ecosystem is, but we should look into unvendoring this like unvendoring OpenSSL is usually done. Change-Id: Id7f2d8b59307c5306e178a38a165c19f426ad8de Signed-off-by: Raito Bezarius Co-authored-by: Elias Coppens --- pkgs/by-name/g3/g3proxy/package.nix | 63 +++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 pkgs/by-name/g3/g3proxy/package.nix diff --git a/pkgs/by-name/g3/g3proxy/package.nix b/pkgs/by-name/g3/g3proxy/package.nix new file mode 100644 index 000000000000..638806304fce --- /dev/null +++ b/pkgs/by-name/g3/g3proxy/package.nix @@ -0,0 +1,63 @@ +{ + lib, + rustPlatform, + fetchFromGitHub, + pkg-config, + stdenv, + darwin, + c-ares, + python3, + lua5_4, + capnproto, + cmake, +}: + +rustPlatform.buildRustPackage rec { + pname = "g3"; + version = "v1.10.4"; + + src = fetchFromGitHub { + owner = "bytedance"; + repo = "g3"; + tag = "g3proxy-${version}"; + hash = "sha256-uafKYyzjGdtC+oMJG1wWOvgkSht/wTOzyODcPoTfOnU="; + }; + + cargoHash = "sha256-NbrJGGnpZkF7ZX3MqrMsZ03tWkN/nqWahh00O3IJGOw="; + useFetchCargoVendor = true; + + # TODO: can we unvendor AWS LC somehow? + buildFeatures = [ + "vendored-aws-lc" + "rustls-aws-lc" + ]; + + # aws-lc/crypto compilation will trigger `strictoverflow` errors. + hardeningDisable = [ "strictoverflow" ]; + + nativeBuildInputs = [ + pkg-config + rustPlatform.bindgenHook + python3 + capnproto + cmake + ]; + + buildInputs = + [ + c-ares + lua5_4 + ] + ++ lib.optionals stdenv.isDarwin [ + darwin.apple_sdk.frameworks.Security + ]; + + meta = { + description = "Enterprise-oriented Generic Proxy Solutions"; + homepage = "https://github.com/bytedance/g3"; + changelog = "https://github.com/bytedance/g3/blob/${src.rev}/CHANGELOG.md"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ raitobezarius ]; + mainProgram = "g3proxy"; + }; +} From f0652b5dff0fdf6dc33cb3ed443fe22102d278d5 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 30 Jan 2025 17:52:01 +0100 Subject: [PATCH 2/2] nixos/services/networking/g3proxy: init This adds a simple hardened systemd-based module for g3proxy, a generic purpose forward proxy. Change-Id: I8c6e5d2cc8a9faa2aea8c5df3af56756ffed542d Signed-off-by: Raito Bezarius Co-authored-by: Elias Coppens --- .../manual/release-notes/rl-2505.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/networking/g3proxy.nix | 92 +++++++++++++++++++ 3 files changed, 95 insertions(+) create mode 100644 nixos/modules/services/networking/g3proxy.nix diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index a0058d668277..cf4b405beb1f 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -133,6 +133,8 @@ - [PowerStation](https://github.com/ShadowBlip/PowerStation/), an open source TDP control and performance daemon with DBus interface for Linux. Available as [services.powerstation](#opt-services.powerstation.enable). +- [`g3proxy`](https://github.com/bytedance/g3), an open source enterprise forward proxy from ByteDance, similar to Squid or tinyproxy. Available as [services.g3proxy](#opt-services.g3proxy.enable). + - [echoip](https://github.com/mpolden/echoip), a simple service for looking up your IP address. Available as [services.echoip](#opt-services.echoip.enable). - [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index dd5b09d91610..d9cbe46320dc 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1266,6 +1266,7 @@ ./services/networking/spacecookie.nix ./services/networking/spiped.nix ./services/networking/squid.nix + ./services/networking/g3proxy.nix ./services/networking/ssh/sshd.nix ./services/networking/sslh.nix ./services/networking/strongswan-swanctl/module.nix diff --git a/nixos/modules/services/networking/g3proxy.nix b/nixos/modules/services/networking/g3proxy.nix new file mode 100644 index 000000000000..6df4f37b1123 --- /dev/null +++ b/nixos/modules/services/networking/g3proxy.nix @@ -0,0 +1,92 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.services.g3proxy; + + inherit (lib) + mkPackageOption + mkEnableOption + mkOption + mkIf + literalExpression + ; + + settingsFormat = pkgs.formats.yaml { }; +in +{ + options.services.g3proxy = { + enable = mkEnableOption "g3proxy, a generic purpose forward proxy"; + + package = mkPackageOption pkgs "g3proxy" { }; + + settings = mkOption { + type = settingsFormat.type; + default = { }; + example = literalExpression '' + { + server = [{ + name = "test"; + escaper = "default"; + type = "socks_proxy"; + listen = { + address = "[::]:10086"; + }; + }]; + } + ''; + description = '' + Settings of g3proxy. + ''; + }; + }; + + config = mkIf cfg.enable { + systemd.services.g3proxy = { + description = "g3proxy server"; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + ExecStart = + let + g3proxy-yaml = settingsFormat.generate "g3proxy.yaml" cfg.settings; + in + "${lib.getExe cfg.package} --config-file ${g3proxy-yaml}"; + + WorkingDirectory = "/var/lib/g3proxy"; + StateDirectory = "g3proxy"; + RuntimeDirectory = "g3proxy"; + DynamicUser = true; + + RuntimeDirectoryMode = "0755"; + PrivateTmp = true; + DevicePolicy = "closed"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + PrivateUsers = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + ProtectSystem = "strict"; + ProcSubset = "pid"; + RestrictNamespaces = true; + RestrictRealtime = true; + RemoveIPC = true; + SystemCallArchitectures = "native"; + UMask = "0077"; + RestrictAddressFamilies = [ + "AF_UNIX" + "AF_INET" + "AF_INET6" + ]; + RestrictSUIDSGID = true; + }; + }; + }; +}