depot/nixos/modules/services/networking/iodine.nix

# NixOS module for iodine, ip over dns daemon
{ config, lib, pkgs, ... }:
let
  cfg = config.services.iodine;

  iodinedUser = "iodined";

  /* is this path made unreadable by ProtectHome = true ? */
  isProtected = x: lib.hasPrefix "/root" x || lib.hasPrefix "/home" x;
in
{
  imports = [
    (lib.mkRenamedOptionModule [ "services" "iodined" "enable" ] [ "services" "iodine" "server" "enable" ])
    (lib.mkRenamedOptionModule [ "services" "iodined" "domain" ] [ "services" "iodine" "server" "domain" ])
    (lib.mkRenamedOptionModule [ "services" "iodined" "ip" ] [ "services" "iodine" "server" "ip" ])
    (lib.mkRenamedOptionModule [ "services" "iodined" "extraConfig" ] [ "services" "iodine" "server" "extraConfig" ])
    (lib.mkRemovedOptionModule [ "services" "iodined" "client" ] "")
  ];

  ### configuration

  options = {

    services.iodine = {
      clients = lib.mkOption {
        default = {};
        description = ''
          Each attribute of this option defines a systemd service that
          runs iodine. Many or none may be defined.
          The name of each service is
          `iodine-«name»`
          where «name» is the name of the
          corresponding attribute name.
        '';
        example = lib.literalExpression ''
          {
            foo = {
              server = "tunnel.mdomain.com";
              relay = "8.8.8.8";
              extraConfig = "-v";
            }
          }
        '';
        type = lib.types.attrsOf (
          lib.types.submodule (
            {
              options = {
                server = lib.mkOption {
                  type = lib.types.str;
                  default = "";
                  description = "Hostname of server running iodined";
                  example = "tunnel.mydomain.com";
                };

                relay = lib.mkOption {
                  type = lib.types.str;
                  default = "";
                  description = "DNS server to use as an intermediate relay to the iodined server";
                  example = "8.8.8.8";
                };

                extraConfig = lib.mkOption {
                  type = lib.types.str;
                  default = "";
                  description = "Additional command line parameters";
                  example = "-l 192.168.1.10 -p 23";
                };

                passwordFile = lib.mkOption {
                  type = lib.types.str;
                  default = "";
                  description = "Path to a file containing the password.";
                };
              };
            }
          )
        );
      };

      server = {
        enable = lib.mkOption {
          type = lib.types.bool;
          default = false;
          description = "enable iodined server";
        };

        ip = lib.mkOption {
          type = lib.types.str;
          default = "";
          description = "The assigned ip address or ip range";
          example = "172.16.10.1/24";
        };

        domain = lib.mkOption {
          type = lib.types.str;
          default = "";
          description = "Domain or subdomain of which nameservers point to us";
          example = "tunnel.mydomain.com";
        };

        extraConfig = lib.mkOption {
          type = lib.types.str;
          default = "";
          description = "Additional command line parameters";
          example = "-l 192.168.1.10 -p 23";
        };

        passwordFile = lib.mkOption {
          type = lib.types.str;
          default = "";
          description = "File that contains password";
        };
      };

    };
  };

  ### implementation

  config = lib.mkIf (cfg.server.enable || cfg.clients != {}) {
    environment.systemPackages = [ pkgs.iodine ];
    boot.kernelModules = [ "tun" ];

    systemd.services =
      let
        createIodineClientService = name: cfg:
          {
            description = "iodine client - ${name}";
            after = [ "network.target" ];
            wantedBy = [ "multi-user.target" ];
            script = "exec ${pkgs.iodine}/bin/iodine -f -u ${iodinedUser} ${cfg.extraConfig} ${lib.optionalString (cfg.passwordFile != "") "< \"${builtins.toString cfg.passwordFile}\""} ${cfg.relay} ${cfg.server}";
            serviceConfig = {
              RestartSec = "30s";
              Restart = "always";

              # hardening :
              # Filesystem access
              ProtectSystem = "strict";
              ProtectHome = if isProtected cfg.passwordFile then "read-only" else "true" ;
              PrivateTmp = true;
              ReadWritePaths = "/dev/net/tun";
              PrivateDevices = false;
              ProtectKernelTunables = true;
              ProtectKernelModules = true;
              ProtectControlGroups = true;
              # Caps
              NoNewPrivileges = true;
              # Misc.
              LockPersonality = true;
              RestrictRealtime = true;
              PrivateMounts = true;
              MemoryDenyWriteExecute = true;
            };
          };
      in
        lib.listToAttrs (
          lib.mapAttrsToList
            (name: value: lib.nameValuePair "iodine-${name}" (createIodineClientService name value))
            cfg.clients
        ) // {
          iodined = lib.mkIf (cfg.server.enable) {
            description = "iodine, ip over dns server daemon";
            after = [ "network.target" ];
            wantedBy = [ "multi-user.target" ];
            script = "exec ${pkgs.iodine}/bin/iodined -f -u ${iodinedUser} ${cfg.server.extraConfig} ${lib.optionalString (cfg.server.passwordFile != "") "< \"${builtins.toString cfg.server.passwordFile}\""} ${cfg.server.ip} ${cfg.server.domain}";
            serviceConfig = {
              # Filesystem access
              ProtectSystem = "strict";
              ProtectHome = if isProtected cfg.server.passwordFile then "read-only" else "true" ;
              PrivateTmp = true;
              ReadWritePaths = "/dev/net/tun";
              PrivateDevices = false;
              ProtectKernelTunables = true;
              ProtectKernelModules = true;
              ProtectControlGroups = true;
              # Caps
              NoNewPrivileges = true;
              # Misc.
              LockPersonality = true;
              RestrictRealtime = true;
              PrivateMounts = true;
              MemoryDenyWriteExecute = true;
            };
          };
        };

    users.users.${iodinedUser} = {
      uid = config.ids.uids.iodined;
      group = "iodined";
      description = "Iodine daemon user";
    };
    users.groups.iodined.gid = config.ids.gids.iodined;
  };
}