dotfiles/nixos/systems/altra/http-synapse-proxy.nix

{ pkgs, inputs', lib, config, ... }:
let
  inherit (lib)
    singleton
    mkForce;
  certs = config.services.acme-sh.certs;
in
{
  users.users.wwwrun = {
    group = "wwwrun";
    isSystemUser = true;
    uid = config.ids.uids.wwwrun;
  };

  users.groups.wwwrun = {
    gid = config.ids.gids.wwwrun;
  };

  systemd.services.apache-proxy =
    let
      apacheConfiguration = inputs'.nixng.nglib.generators.toApache [
        {
          LoadModule = [
            [ "mpm_event_module" "modules/mod_mpm_event.so" ]
            [ "log_config_module" "modules/mod_log_config.so" ]
            [ "unixd_module" "modules/mod_unixd.so" ]
            [ "authz_core_module" "modules/mod_authz_core.so" ]
            [ "authn_core_module" "modules/mod_authn_core.so" ]
            [ "dir_module" "modules/mod_dir.so" ]
            [ "mime_module" "modules/mod_mime.so" ]
            [ "proxy_module" "modules/mod_proxy.so" ]
            [ "proxy_http_module" "modules/mod_proxy_http.so" ]
            [ "access_compat_module" "modules/mod_access_compat.so" ]
            [ "proxy_connect_module" "modules/mod_proxy_connect.so" ]
            [ "authn_file_module" "modules/mod_authn_file.so" ]
            [ "authz_user_module" "modules/mod_authz_user.so" ]
            [ "authz_host_module" "modules/mod_authz_host.so" ]
            [ "auth_basic_module" "modules/mod_auth_basic.so" ]
            [ "ssl_module" "modules/mod_ssl.so" ]
          ];
        }
        {
          Listen = "0.0.0.0:8883";

          ServerRoot = "/var/empty";
          ServerName = "altra";
          PidFile = "/run/apache/apache.pid";

          DocumentRoot = "/var/empty";
        }

        {
          ErrorLog = "/var/log/apache/error.log";
          TransferLog = "/var/log/apache/access.log";
        }
        {
          MaxConnectionsPerChild = 1024;
          MaxMemFree = 8192;

          ThreadsPerChild = 64;
          MaxRequestWorkers = 2048;
          ServerLimit = 32;
          AsyncRequestWorkerFactor = 8;
        }
        {
          AddType = singleton [
            "image/svg+xml"
            "svg"
            "svgz"
          ];
          AddEncoding = [
            "gzip"
            "svgz"
          ];

          TypesConfig = "${pkgs.apacheHttpd}/conf/mime.types";
        }

        {
          Directory."/" = {
            Require = [ "all" "denied" ];
            Options = "SymlinksIfOwnerMatch";
          };

          VirtualHost."*:8883" = [
            {
              ProxyRequests = "on";
              AddDefaultCharset = "off";
              AllowCONNECT = [ "443" "8448" "8433" "8478" "3236" "8080" ];
            }
            {
              ServerName = "synapse-proxy.in.redalder.org";
              SSLEngine = "on";
              SSLCertificateFile = certs.apache-proxy.certPath;
              SSLCertificateKeyFile = certs.apache-proxy.keyPath;
              SSLCipherSuite = "HIGH:!aNULL:!MD5";
            }
            {
              Proxy."*" = {
                Require = [ "all" "denied" ];
              };
            }
            {
              ProxyMatch."^([a-zA-Z\-_0-9]+\.)+[a-zA-Z\-_0-9]*:(443|8448|8443|8478|3236|8080).*$" = {
                AuthType = "Basic";
                AuthName = "\"Password Required\"";
                AuthUserFile = "/var/secrets/htpasswd";


                RequireAll."" = {
                  Require = [
                    [ "user synapse" ]
                    [ "method CONNECT" ]
                  ];
                  RequireAny."" = {
                    Require = [
                      [ "ip 10.64.0.2" ]
                    ];
                  };
                };
              };
            }
            {
              ProxyMatch."^http:\/\/([a-zA-Z\-_0-9]+\.)+[a-zA-Z\-_0-9]*(|:(80|8080))$" = {
                AuthType = "Basic";
                AuthName = "\"Password Required\"";
                AuthUserFile = "/var/secrets/htpasswd";


                RequireAll."" = {
                  Require = [
                    [ "user synapse" ]
                    [ "not method CONNECT"]
                  ];
                  RequireAny."" = {
                    Require = [
                      [ "ip 10.64.0.2" ]
                    ];
                  };
                };
              };
            }
          ];
        }
      ];
    in
      {
        serviceConfig = {
          Type = "forking";
          Restart = "always";
          RestartSec = "10s";
          # User and group
          User = "wwwrun";
          Group = "wwwrun";
          # Runtime directory and mode
          RuntimeDirectory = "apache";
          RuntimeDirectoryMode = "0750";
          # Cache directory and mode
          CacheDirectory = "apache";
          CacheDirectoryMode = "0750";
          # Logs directory and mode
          LogsDirectory = "apache";
          LogsDirectoryMode = "0750";
          # Proc filesystem
          ProcSubset = "pid";
          ProtectProc = "invisible";
          # New file permissions
          UMask = "0027"; # 0640 / 0750
          # Capabilities
          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
          # Security
          NoNewPrivileges = true;
          # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
          ProtectSystem = "strict";
          ProtectHome = true;
          PrivateTmp = true;
          PrivateDevices = true;
          ProtectHostname = true;
          ProtectClock = true;
          ProtectKernelTunables = true;
          ProtectKernelModules = true;
          ProtectKernelLogs = true;
          ProtectControlGroups = true;
          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
          RestrictNamespaces = true;
          LockPersonality = true;
          MemoryDenyWriteExecute = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          RemoveIPC = true;
          PrivateMounts = true;
          # System Call Filtering
          SystemCallArchitectures = "native";
          SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid ~@ipc" ];
        };
        wantedBy = [ "multi-user.target" ];
        script = ''
          ls /proc/self/fd /dev
          ${pkgs.apacheHttpd}/bin/httpd -f ${pkgs.writeText "apache.conf" apacheConfiguration}
        '';
      };

  services.acme-sh.certs.apache-proxy = {
    production = true;
    user = "wwwrun";
    domains."synapse-proxy.in.redalder.org" = "dns_hetzner";
    mainDomain = "synapse-proxy.in.redalder.org";
    postRun = "systemctl try-reload-or-restart --no-block apache-proxy.service";
  };

  systemd.services."acme-sh-apache-proxy" = {
    serviceConfig.EnvironmentFile = mkForce "/var/secrets/hetzner.env";
  };
}