mynix/system
1
1
Fork 0
Code Issues 2 Pull requests Activity

modules/browsers: move all browsers to the container

Browse source
This commit is contained in:
Dmitriy Pleshevskiy 2024-08-22 22:27:39 +03:00
parent 4366a215e6
commit b86e59d968
Signed by: pleshevskiy
GPG key ID: 17041163DA10A9A2
8 changed files with 145 additions and 129 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
hosts/asus-gl553vd/configs/imp.nix
View file

@ -46,6 +46,7 @@
"/var/lib/nixos"
"/var/lib/systemd/coredump"
"/etc/NetworkManager/system-connections"
"/etc/ssh/per-machine"
];
files = [
"/etc/machine-id"
@ -66,5 +67,11 @@
];
files = [ "/var/lib/docker/engine-id" ];
};
"/presistent/ollama" = lib.mkIf config.services.ollama.enable {
hideMounts = true;
directories = [
"/var/lib/private/ollama"
];
};
};
}

15
hosts/asus-gl553vd/configuration.nix
View file

@ -1,4 +1,4 @@
{ globalData, ... }:
{ pkgs, ... }:
{
imports = [
@ -26,12 +26,9 @@
################################################################################
# Programs
################################################################################
local.programs.browsers.tor-browser = {
enable = true;
container = {
enable = true;
externalInterface = "wg0";
sshAuthorizedKeys = globalData.publicKeys.users.jan;
};
};
local.programs.browsers.tor-browser.enable = true;
environment.shellInit = ''
[ -n "$DISPLAY" ] && ${pkgs.xorg.xhost}/bin/xhost +si:localuser:$USER > /dev/null || true
'';
}

12
hosts/home/configuration.nix
View file

@ -1,4 +1,4 @@
{ config, globalData, pkgs, ... }:
{ config, pkgs, ... }:
{
imports = [
@ -12,14 +12,7 @@
################################################################################
# Programs
################################################################################
local.programs.browsers.tor-browser = {
enable = true;
container = {
enable = true;
externalInterface = "wg0";
sshAuthorizedKeys = globalData.publicKeys.users.jan;
};
};
local.programs.browsers.tor-browser.enable = true;
################################################################################
# Services
@ -87,6 +80,7 @@
environment.sessionVariables = {
DISPLAY = ":0";
PULSE_SERVER = "tcp:127.0.0.1:4713";
XAUTHORITY = "/home/john/.Xauthority";
WINEPREFIX = "/home/john/.wine";
WINEARCH = "win32";

120
modules/nixos/programs/browsers/default.nix
View file

@ -1,8 +1,126 @@
{ ... }:
{ config, pkgs, lib, ... }:
let
cfg = config.local.programs.browsers;
hostAddress = "192.168.7.10";
localAddress = "192.168.7.11";
hostRunBrowser = pkgs.writeScript "run-browser" ''
host=browsers.containers
if [ -z "$(ssh-keygen -F $host)" ]; then
ssh-keyscan -H $host >> ~/.ssh/known_hosts
fi
ssh -o PubkeyAuthentication=no kira@$host $@
'';
contPackages =
lib.optional cfg.tor-browser.enable cfg.tor-browser.package
++ lib.optional cfg.librewolf.enable cfg.librewolf.package
++ lib.optional cfg.mullvad-browser.enable cfg.mullvad-browser.package;
hostPackages = lib.flip map contPackages (p:
pkgs.writeScriptBin "${p.meta.mainProgram}" ''
${hostRunBrowser} ${p.meta.mainProgram}
''
);
isEnable = cfg.tor-browser.enable
or cfg.librewolf.enable
or cfg.mullvad-browser.enable;
in
{
imports = [
./tor-browser.nix
./mullvad-browser.nix
./librewolf.nix
];
config = lib.mkIf isEnable {
environment.systemPackages = hostPackages;
hardware.pulseaudio = {
systemWide = true;
support32Bit = true;
tcp = {
enable = true;
anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
};
};
networking = {
firewall = {
allowedTCPPorts = [ 4713 ];
trustedInterfaces = [ "ve-*" ];
};
nat = {
enable = true;
internalInterfaces = [ "ve-browsers" ];
externalInterface = "wg0";
};
};
containers.browsers = {
autoStart = true;
ephemeral = true;
privateNetwork = true;
inherit hostAddress localAddress;
bindMounts = lib.mkMerge [
{
"/tmp/.X11-unix" = { };
"/etc/ssh/keys" = {
isReadOnly = false;
hostPath = "/etc/ssh/per-machine/browsers";
};
"/home/kira/Downloads" = {
isReadOnly = false;
hostPath = "/home/jan/downloads/browser";
};
}
(lib.mkIf cfg.librewolf.enable {
"/home/kira/.librewolf" = {
isReadOnly = false;
hostPath = "/home/jan/.librewolf";
};
})
];
config = { pkgs, ... }: {
system.stateVersion = "23.11";
services.openssh = {
enable = true;
settings.PasswordAuthentication = true;
hostKeys = [
{
bits = 4096;
path = "/etc/ssh/keys/ssh_host_rsa_key";
type = "rsa";
}
{
path = "/etc/ssh/keys/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
users.users.kira = {
isNormalUser = true;
home = "/home/kira";
password = "hello";
extraGroups = [ "pulse-access" ];
packages = contPackages;
};
environment.sessionVariables = {
DISPLAY = ":0";
PULSE_SERVER = "tcp:${hostAddress}:4713";
XAUTHORITY = "/home/kira/.Xauthority";
DBUS_SESSION_BUS_ADDRESS = "";
};
};
};
};
}

6
modules/nixos/programs/browsers/librewolf.nix
View file

@ -1,7 +1,6 @@
{ config, pkgs, lib, inputs, ... }:
let
cfg = config.local.programs.browsers.librewolf;
isPassEnabled = config.local.programs.pass.enable;
policiesJson = pkgs.callPackage ./policies.nix {
@ -20,9 +19,6 @@ in
{
options.local.programs.browsers.librewolf = with lib; {
enable = mkEnableOption "librewolf";
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ librewolf' ];
package = mkPackageOption pkgs "librewolf" {} // { default = librewolf'; };
};
}

9
modules/nixos/programs/browsers/mullvad-browser.nix
View file

@ -1,8 +1,6 @@
{ config, pkgs, lib, inputs, ... }:
{ pkgs, lib, inputs, ... }:
let
cfg = config.local.programs.browsers.mullvad-browser;
policiesJson = pkgs.callPackage ./policies.nix {
firefoxAddons = inputs.firefox-addons.packages."${pkgs.system}";
withRedirectorAddon = true;
@ -21,9 +19,6 @@ in
{
options.local.programs.browsers.mullvad-browser = with lib; {
enable = mkEnableOption "mullvad-browser";
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ mullvadBrowser ];
package = mkPackageOption pkgs "mullvad-browser" {} // { default = mullvadBrowser; };
};
}

10
modules/nixos/programs/browsers/policies.nix
View file

@ -28,7 +28,7 @@ writeText "policies.json" (builtins.toJSON {
SearchEngines = {
Add = [
{
Alias = "sx";
Alias = "@sx";
Name = "SearXNG";
Description = "SearXNG — a privacy-respecting, open metasearch engine";
IconURL = "https://search.sapti.me/static/themes/simple/img/favicon.png";
@ -36,28 +36,28 @@ writeText "policies.json" (builtins.toJSON {
}
] ++ lib.optionals withAllSearchEngines [
{
Alias = "np";
Alias = "@np";
Name = "NixOS Packages";
Description = "Search NixOS packages by name or description.";
IconURL = "https://nixos.org/favicon.png";
URLTemplate = "https://search.nixos.org/packages?query={searchTerms}";
}
{
Alias = "no";
Alias = "@no";
Name = "NixOS Options";
Description = "Search NixOS options by name or description.";
IconURL = "https://nixos.org/favicon.png";
URLTemplate = "https://search.nixos.org/options?query={searchTerms}";
}
{
Alias = "ng";
Alias = "@ng";
Name = "Noogle";
Description = "Search for nix functions by name.";
IconURL = "https://noogle.dev/favicon.png";
URLTemplate = "https://noogle.dev/q?term={searchTerms}";
}
{
Alias = "hg";
Alias = "@hg";
Name = "Hoogle";
Description = ''
Hoogle is a Haskell API search engine, which allows you to

95
modules/nixos/programs/browsers/tor-browser.nix
View file

@ -1,8 +1,6 @@
{ config, pkgs, lib, ... }:
{ pkgs, lib, ... }:
let
cfg = config.local.programs.browsers.tor-browser;
policiesJson = pkgs.callPackage ./policies.nix { };
torBrowser = (pkgs.tor-browser-bundle-bin.override {
@ -18,95 +16,6 @@ in
{
options.local.programs.browsers.tor-browser = with lib; {
enable = mkEnableOption "tor-browser";
container = {
enable = mkEnableOption "tor-browser inside a container";
externalInterface = mkOption {
type = types.str;
default = "";
};
sshAuthorizedKeys = mkOption {
type = types.listOf types.str;
default = [ ];
};
};
};
config = lib.mkIf cfg.enable (lib.mkMerge [
(lib.mkIf (!cfg.container.enable) {
environment.systemPackages = [ torBrowser ];
})
(lib.mkIf cfg.container.enable (
let
hostRunTorBrowser = pkgs.writeScriptBin "tor-browser" ''
${pkgs.socat}/bin/socat -d TCP-LISTEN:6000,fork,bind=192.168.7.10 UNIX-CONNECT:/tmp/.X11-unix/X0 &
${pkgs.xorg.xhost}/bin/xhost +
ssh -X browser@192.168.7.11 tor-browser
${pkgs.xorg.xhost}/bin/xhost -
'';
clientRunTorBrowser = pkgs.writeScriptBin "tor-browser" ''
PULSE_SERVER=tcp:192.168.7.10:4713 \
XAUTHORITY="/home/browser/.Xauthority" \
DBUS_SESSION_BUS_ADDRESS="" \
DISPLAY=192.168.7.10:0.0 \
${pkgs.apulse}/bin/apulse ${torBrowser}/bin/tor-browser $@
'';
in
{
assertions = [
{
assertion = cfg.container.externalInterface != "";
message = "The `tor-browser` module with the `isContainer` option enabled requires a non-empty `externalInterface` with Internet access";
}
{
assertion = cfg.container.sshAuthorizedKeys != [ ];
message = "The `tor-browser` module with the `isContainer` option enabled requires a non-empty `sshAuthorizedKeys` to connect to the container";
}
];
environment.systemPackages = [ hostRunTorBrowser ];
hardware.pulseaudio = {
systemWide = true;
support32Bit = true;
tcp = {
enable = true;
anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
};
};
networking = {
firewall.allowedTCPPorts = [ 4713 6000 ];
nat = {
enable = true;
internalInterfaces = [ "ve-browser" ];
externalInterface = cfg.container.externalInterface;
};
};
containers.browser = {
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.7.10";
localAddress = "192.168.7.11";
config = { ... }: {
system.stateVersion = "23.11";
services.openssh = {
enable = true;
settings.X11Forwarding = true;
};
users.extraUsers.browser = {
isNormalUser = true;
home = "/home/browser";
openssh.authorizedKeys.keys = cfg.container.sshAuthorizedKeys;
extraGroups = [ "pulse-access" ];
packages = [ clientRunTorBrowser ];
};
};
package = mkPackageOption pkgs "tor-browser-bundle-bin" {} // { default = torBrowser; };
};
}
))
]);
}