From c197e4a1e0e3bc8a628e4de197b2e88c23af605e Mon Sep 17 00:00:00 2001 From: MinerSebas Date: Sat, 16 Mar 2024 07:27:14 +0100 Subject: [PATCH 1/3] restic-rest-server: add nixos test --- nixos/tests/all-tests.nix | 1 + nixos/tests/restic-rest-server.nix | 122 +++++++++++++++++++++++ pkgs/tools/backup/restic/rest-server.nix | 4 +- 3 files changed, 126 insertions(+), 1 deletion(-) create mode 100644 nixos/tests/restic-rest-server.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index b2e824642092..b83aea07494f 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -761,6 +761,7 @@ in { redis = handleTest ./redis.nix {}; redmine = handleTest ./redmine.nix {}; restartByActivationScript = handleTest ./restart-by-activation-script.nix {}; + restic-rest-server = handleTest ./restic-rest-server.nix {}; restic = handleTest ./restic.nix {}; retroarch = handleTest ./retroarch.nix {}; rkvm = handleTest ./rkvm {}; diff --git a/nixos/tests/restic-rest-server.nix b/nixos/tests/restic-rest-server.nix new file mode 100644 index 000000000000..b6540b551325 --- /dev/null +++ b/nixos/tests/restic-rest-server.nix @@ -0,0 +1,122 @@ +import ./make-test-python.nix ( + { pkgs, ... }: + + let + remoteRepository = "rest:http://restic_rest_server:8001/"; + + backupPrepareCommand = '' + touch /root/backupPrepareCommand + test ! -e /root/backupCleanupCommand + ''; + + backupCleanupCommand = '' + rm /root/backupPrepareCommand + touch /root/backupCleanupCommand + ''; + + testDir = pkgs.stdenvNoCC.mkDerivation { + name = "test-files-to-backup"; + unpackPhase = "true"; + installPhase = '' + mkdir $out + echo some_file > $out/some_file + echo some_other_file > $out/some_other_file + mkdir $out/a_dir + echo a_file > $out/a_dir/a_file + ''; + }; + + passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}"; + paths = [ "/opt" ]; + exclude = [ "/opt/excluded_file_*" ]; + pruneOpts = [ + "--keep-daily 2" + "--keep-weekly 1" + "--keep-monthly 1" + "--keep-yearly 99" + ]; + in + { + name = "restic-rest-server"; + + nodes = { + restic_rest_server = { + services.restic.server = { + enable = true; + extraFlags = [ "--no-auth" ]; + listenAddress = ":8001"; + }; + networking.firewall.allowedTCPPorts = [ 8001 ]; + }; + server = { + services.restic.backups = { + remotebackup = { + inherit passwordFile paths exclude pruneOpts backupPrepareCommand backupCleanupCommand; + repository = remoteRepository; + initialize = true; + timerConfig = null; # has no effect here, just checking that it doesn't break the service + }; + remoteprune = { + inherit passwordFile; + repository = remoteRepository; + pruneOpts = [ "--keep-last 1" ]; + }; + }; + }; + }; + + testScript = '' + restic_rest_server.start() + server.start() + restic_rest_server.wait_for_unit("restic-rest-server.service") + restic_rest_server.wait_for_open_port(8001) + server.wait_for_unit("dbus.socket") + server.fail( + "restic-remotebackup snapshots", + ) + server.succeed( + # set up + "cp -rT ${testDir} /opt", + "touch /opt/excluded_file_1 /opt/excluded_file_2", + + # test that remotebackup runs custom commands and produces a snapshot + "timedatectl set-time '2016-12-13 13:45'", + "systemctl start restic-backups-remotebackup.service", + "rm /root/backupCleanupCommand", + 'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"', + + # test that restoring that snapshot produces the same directory + "mkdir /tmp/restore-1", + "restic-remotebackup restore latest -t /tmp/restore-1", + "diff -ru ${testDir} /tmp/restore-1/opt", + + # test that we can create four snapshots in remotebackup and rclonebackup + "timedatectl set-time '2017-12-13 13:45'", + "systemctl start restic-backups-remotebackup.service", + "rm /root/backupCleanupCommand", + + "timedatectl set-time '2018-12-13 13:45'", + "systemctl start restic-backups-remotebackup.service", + "rm /root/backupCleanupCommand", + + "timedatectl set-time '2018-12-14 13:45'", + "systemctl start restic-backups-remotebackup.service", + "rm /root/backupCleanupCommand", + + "timedatectl set-time '2018-12-15 13:45'", + "systemctl start restic-backups-remotebackup.service", + "rm /root/backupCleanupCommand", + + "timedatectl set-time '2018-12-16 13:45'", + "systemctl start restic-backups-remotebackup.service", + "rm /root/backupCleanupCommand", + + 'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 4"', + + # test that remoteprune brings us back to 1 snapshot in remotebackup + "systemctl start restic-backups-remoteprune.service", + 'restic-remotebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"', + ) + ''; + } +) diff --git a/pkgs/tools/backup/restic/rest-server.nix b/pkgs/tools/backup/restic/rest-server.nix index 9af1151518b6..f36244d94b55 100644 --- a/pkgs/tools/backup/restic/rest-server.nix +++ b/pkgs/tools/backup/restic/rest-server.nix @@ -1,4 +1,4 @@ -{ lib, buildGoModule, fetchFromGitHub }: +{ lib, buildGoModule, fetchFromGitHub, nixosTests }: buildGoModule rec { pname = "restic-rest-server"; @@ -13,6 +13,8 @@ buildGoModule rec { vendorHash = "sha256-tD5ffIYULMBqu99l1xCL0RnLB9zNpwNPs1qVFqezUc8="; + passthru.tests.restic = nixosTests.restic-rest-server; + meta = with lib; { changelog = "https://github.com/restic/rest-server/blob/${src.rev}/CHANGELOG.md"; description = "A high performance HTTP server that implements restic's REST backend API"; From 7762c2233c801f22cb0e377dcef2a2b510609f9b Mon Sep 17 00:00:00 2001 From: MinerSebas Date: Sat, 16 Mar 2024 07:32:20 +0100 Subject: [PATCH 2/3] nixos/restic-rest-server: Add additional service hardening --- .../services/backup/restic-rest-server.nix | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/backup/restic-rest-server.nix b/nixos/modules/services/backup/restic-rest-server.nix index 105a05caf304..34a2c51bbb27 100644 --- a/nixos/modules/services/backup/restic-rest-server.nix +++ b/nixos/modules/services/backup/restic-rest-server.nix @@ -80,13 +80,30 @@ in Group = "restic"; # Security hardening - ReadWritePaths = [ cfg.dataDir ]; + CapabilityBoundingSet = ""; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; PrivateTmp = true; + PrivateUsers = true; + ProtectClock = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectProc = "invisible"; ProtectSystem = "strict"; ProtectKernelTunables = true; ProtectKernelModules = true; ProtectControlGroups = true; PrivateDevices = true; + ReadWritePaths = [ cfg.dataDir ]; + RemoveIPC = true; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = "@system-service"; + UMask = 027; }; }; From 9e1fe5cddd5c786c0fcceff37a90d9837dc68bcb Mon Sep 17 00:00:00 2001 From: MinerSebas Date: Sat, 16 Mar 2024 08:30:18 +0100 Subject: [PATCH 3/3] nixos/restic-rest-server: Make the service socket activated --- .../services/backup/restic-rest-server.nix | 18 +++++++++++++++--- nixos/tests/restic-rest-server.nix | 4 ++-- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/backup/restic-rest-server.nix b/nixos/modules/services/backup/restic-rest-server.nix index 34a2c51bbb27..c9d5a37116a1 100644 --- a/nixos/modules/services/backup/restic-rest-server.nix +++ b/nixos/modules/services/backup/restic-rest-server.nix @@ -12,7 +12,7 @@ in enable = mkEnableOption (lib.mdDoc "Restic REST Server"); listenAddress = mkOption { - default = ":8000"; + default = "8000"; example = "127.0.0.1:8080"; type = types.str; description = lib.mdDoc "Listen on a specific IP address and port."; @@ -61,14 +61,19 @@ in }; config = mkIf cfg.enable { + assertions = [{ + assertion = lib.substring 0 1 cfg.listenAddress != ":"; + message = "The restic-rest-server now uses systemd socket activation, which expects only the Port number: services.restic.server.listenAddress = \"${lib.substring 1 6 cfg.listenAddress}\";"; + }]; + systemd.services.restic-rest-server = { description = "Restic REST Server"; - after = [ "network.target" ]; + after = [ "network.target" "restic-rest-server.socket" ]; + requires = [ "restic-rest-server.socket" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = '' ${cfg.package}/bin/rest-server \ - --listen ${cfg.listenAddress} \ --path ${cfg.dataDir} \ ${optionalString cfg.appendOnly "--append-only"} \ ${optionalString cfg.privateRepos "--private-repos"} \ @@ -84,6 +89,7 @@ in LockPersonality = true; MemoryDenyWriteExecute = true; NoNewPrivileges = true; + PrivateNetwork = true; PrivateTmp = true; PrivateUsers = true; ProtectClock = true; @@ -98,6 +104,7 @@ in PrivateDevices = true; ReadWritePaths = [ cfg.dataDir ]; RemoveIPC = true; + RestrictAddressFamilies = "none"; RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; @@ -107,6 +114,11 @@ in }; }; + systemd.sockets.restic-rest-server = { + listenStreams = [ cfg.listenAddress ]; + wantedBy = [ "sockets.target" ]; + }; + systemd.tmpfiles.rules = mkIf cfg.privateRepos [ "f ${cfg.dataDir}/.htpasswd 0700 restic restic -" ]; diff --git a/nixos/tests/restic-rest-server.nix b/nixos/tests/restic-rest-server.nix index b6540b551325..1d38ddbe513c 100644 --- a/nixos/tests/restic-rest-server.nix +++ b/nixos/tests/restic-rest-server.nix @@ -44,7 +44,7 @@ import ./make-test-python.nix ( services.restic.server = { enable = true; extraFlags = [ "--no-auth" ]; - listenAddress = ":8001"; + listenAddress = "8001"; }; networking.firewall.allowedTCPPorts = [ 8001 ]; }; @@ -68,7 +68,7 @@ import ./make-test-python.nix ( testScript = '' restic_rest_server.start() server.start() - restic_rest_server.wait_for_unit("restic-rest-server.service") + restic_rest_server.wait_for_unit("restic-rest-server.socket") restic_rest_server.wait_for_open_port(8001) server.wait_for_unit("dbus.socket") server.fail(