From ab7e0e63841e4019a690d4c23f4ab30c697eef20 Mon Sep 17 00:00:00 2001 From: Casey Link Date: Mon, 18 Mar 2024 09:50:43 +0100 Subject: [PATCH 1/3] maintainers: add ramblurr --- maintainers/maintainer-list.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 425b7352172a..efa9064bab50 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -16173,6 +16173,15 @@ githubId = 104558; name = "Benjamin Saunders"; }; + ramblurr = { + name = "Casey Link"; + email = "nix@caseylink.com"; + github = "Ramblurr"; + githubId = 14830; + keys = [{ + fingerprint = "978C 4D08 058B A26E B97C B518 2078 2DBC ACFA ACDA"; + }]; + }; ramkromberg = { email = "ramkromberg@mail.com"; github = "RamKromberg"; From 4d16584c41403847d2e9689e6a2f28a96e26fe9b Mon Sep 17 00:00:00 2001 From: Casey Link Date: Mon, 18 Mar 2024 09:53:14 +0100 Subject: [PATCH 2/3] microsocks: init at 1.0.4 --- pkgs/by-name/mi/microsocks/package.nix | 33 ++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 pkgs/by-name/mi/microsocks/package.nix diff --git a/pkgs/by-name/mi/microsocks/package.nix b/pkgs/by-name/mi/microsocks/package.nix new file mode 100644 index 000000000000..8c773bc1c3fe --- /dev/null +++ b/pkgs/by-name/mi/microsocks/package.nix @@ -0,0 +1,33 @@ +{ stdenv, + fetchFromGitHub, + lib, +}: + +stdenv.mkDerivation rec { + pname = "microsocks"; + version = "1.0.4"; + + src = fetchFromGitHub { + owner = "rofl0r"; + repo = "microsocks"; + rev = "v${version}"; + hash = "sha256-cB2XMWjoZ1zLAmAfl/nqjdOyBDKZ+xtlEmqsZxjnFn0="; + }; + + installPhase = '' + runHook preInstall + + install -Dm 755 microsocks -t $out/bin/ + + runHook postInstall + ''; + + meta = { + changelog = "https://github.com/rofl0r/microsocks/releases/tag/v${version}"; + description = "Tiny, portable SOCKS5 server with very moderate resource usage"; + homepage = "https://github.com/rofl0r/microsocks"; + license = lib.licenses.mit; + mainProgram = "microsocks"; + maintainers = with lib.maintainers; [ ramblurr ]; + }; +} From cef226e553390c05a4c43b379133fc67a8b4cf5b Mon Sep 17 00:00:00 2001 From: Casey Link Date: Mon, 25 Mar 2024 13:34:02 +0100 Subject: [PATCH 3/3] nixos/microsocks: init --- .../manual/release-notes/rl-2405.section.md | 2 + nixos/modules/module-list.nix | 1 + .../services/networking/microsocks.nix | 146 ++++++++++++++++++ 3 files changed, 149 insertions(+) create mode 100644 nixos/modules/services/networking/microsocks.nix diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md index 436bd5101233..8bf84c2d32c5 100644 --- a/nixos/doc/manual/release-notes/rl-2405.section.md +++ b/nixos/doc/manual/release-notes/rl-2405.section.md @@ -111,6 +111,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m - [Pretix](https://pretix.eu/about/en/), an open source ticketing software for events. Available as [services.pretix]($opt-services-pretix.enable). +- [microsocks](https://github.com/rofl0r/microsocks), a tiny, portable SOCKS5 server with very moderate resource usage. Available as [services.microsocks]($opt-services-microsocks.enable). + - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable). - [fritz-exporter](https://github.com/pdreker/fritz_exporter), a Prometheus exporter for extracting metrics from [FRITZ!](https://avm.de/produkte/) devices. Available as [services.prometheus.exporters.fritz](#opt-services.prometheus.exporters.fritz.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 299b163844f8..439341f44357 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1020,6 +1020,7 @@ ./services/networking/lxd-image-server.nix ./services/networking/magic-wormhole-mailbox-server.nix ./services/networking/matterbridge.nix + ./services/networking/microsocks.nix ./services/networking/mihomo.nix ./services/networking/minidlna.nix ./services/networking/miniupnpd.nix diff --git a/nixos/modules/services/networking/microsocks.nix b/nixos/modules/services/networking/microsocks.nix new file mode 100644 index 000000000000..be79a8495636 --- /dev/null +++ b/nixos/modules/services/networking/microsocks.nix @@ -0,0 +1,146 @@ +{ config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.microsocks; + + cmd = + if cfg.execWrapper != null + then "${cfg.execWrapper} ${cfg.package}/bin/microsocks" + else "${cfg.package}/bin/microsocks"; + args = + [ "-i" cfg.ip "-p" (toString cfg.port) ] + ++ lib.optionals (cfg.authOnce) [ "-1" ] + ++ lib.optionals (cfg.disableLogging) [ "-q" ] + ++ lib.optionals (cfg.outgoingBindIp != null) [ "-b" cfg.outgoingBindIp ] + ++ lib.optionals (cfg.authUsername != null) [ "-u" cfg.authUsername ]; +in { + options.services.microsocks = { + enable = lib.mkEnableOption (lib.mdDoc "Tiny, portable SOCKS5 server with very moderate resource usage"); + user = lib.mkOption { + default = "microsocks"; + description = lib.mdDoc "User microsocks runs as."; + type = lib.types.str; + }; + group = lib.mkOption { + default = "microsocks"; + description = lib.mdDoc "Group microsocks runs as."; + type = lib.types.str; + }; + package = lib.mkPackageOption pkgs "microsocks" {}; + ip = lib.mkOption { + type = lib.types.str; + default = "127.0.0.1"; + description = lib.mdDoc '' + IP on which microsocks should listen. Defaults to 127.0.0.1 for + security reasons. + ''; + }; + port = lib.mkOption { + type = lib.types.port; + default = 1080; + description = lib.mdDoc "Port on which microsocks should listen."; + }; + disableLogging = lib.mkOption { + type = lib.types.bool; + default = false; + description = lib.mdDoc "If true, microsocks will not log any messages to stdout/stderr."; + }; + authOnce = lib.mkOption { + type = lib.types.bool; + default = false; + description = lib.mdDoc '' + If true, once a specific ip address authed successfully with user/pass, + it is added to a whitelist and may use the proxy without auth. + ''; + }; + outgoingBindIp = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + description = lib.mdDoc "Specifies which ip outgoing connections are bound to"; + }; + authUsername = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + example = "alice"; + description = lib.mdDoc "Optional username to use for authentication."; + }; + authPasswordFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + example = "/run/secrets/microsocks-password"; + description = lib.mdDoc "Path to a file containing the password for authentication."; + }; + execWrapper = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + example = '' + ''${pkgs.mullvad-vpn}/bin/mullvad-exclude + ''; + description = lib.mdDoc '' + An optional command to prepend to the microsocks command (such as proxychains, or a VPN exclude command). + ''; + }; + }; + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = (cfg.authUsername != null) == (cfg.authPasswordFile != null); + message = "Need to set both authUsername and authPasswordFile for microsocks"; + } + ]; + users = { + users = lib.mkIf (cfg.user == "microsocks") { + microsocks = { + group = cfg.group; + isSystemUser = true; + }; + }; + groups = lib.mkIf (cfg.group == "microsocks") { + microsocks = {}; + }; + }; + systemd.services.microsocks = { + enable = true; + description = "a tiny socks server"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + User = cfg.user; + Group = cfg.group; + Restart = "on-failure"; + RestartSec = 10; + LoadCredential = lib.optionalString (cfg.authPasswordFile != null) "MICROSOCKS_PASSWORD_FILE:${cfg.authPasswordFile}"; + MemoryDenyWriteExecute = true; + SystemCallArchitectures = "native"; + PrivateTmp = true; + NoNewPrivileges = true; + ProtectSystem = "strict"; + ProtectHome = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + PrivateDevices = true; + RestrictSUIDSGID = true; + RestrictNamespaces = [ + "cgroup" + "ipc" + "pid" + "user" + "uts" + ]; + }; + script = + if cfg.authPasswordFile != null + then '' + PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/MICROSOCKS_PASSWORD_FILE") + ${cmd} ${lib.escapeShellArgs args} -P "$PASSWORD" + '' + else '' + ${cmd} ${lib.escapeShellArgs args} + ''; + }; + }; +}