pomerium: init at 0.13.3 #108745

lukegb · 2021-01-08T03:06:07Z

Motivation for this change

Packages the Pomerium authenticating HTTP proxy.

Things done

aanderse

Hi. I have left reviewed the module portion of this PR and left some comments I hope you will find useful. Let me know if you have any questions, etc...

nixos/modules/services/web-servers/pomerium.nix

lukegb · 2021-01-09T00:48:19Z

@ofborg eval
@ofborg test pomerium
@ofborg build pomerium

aanderse · 2021-01-16T04:14:01Z

@lukegb looks like a failed test.

lukegb · 2021-01-16T21:28:36Z

@aanderse I'm parking this until #108741 is merged, which should make this PR a little simpler

lukegb · 2021-01-19T17:59:50Z

@aanderse Thanks! Should be ready for review again.

aanderse · 2021-01-22T02:30:25Z

@lukegb please see above comment: #108745 (comment)

lukegb · 2021-01-24T16:26:30Z

@lukegb please see above comment: #108745 (comment)

done! sorry for the delay

aanderse · 2021-01-26T00:09:48Z

@lukegb this module is awesome! Great work on it. I'm not familiar with the software at all, though... Can we find anyone else to chip in with review? Maybe @marvin-mk2 can help us out? How about you @m1cr0man - are you familiar with this at all?

/marvin opt-in
/status needs_reviewer

m1cr0man

This is some great work. I'm not familiar with pomerium, but the test suite looks solid and the systemd service has an impressive amount of hardening 😃

My only gripe is with the use of LoadCredential. If pomerium does support hot reloads via process signals then I would prefer to see CERTIFICATE[_KEY]_FILE env vars set to the full path to the cert. This creates a new problem in that you would also need to change how DynamicUser is used. From what I understand of the DynamicUser docs, setting Group to "acme" should be sufficient. As it is now your solution is more secure and in reality Apache has worked similarly in the past and no one complained 😉

Also see my note about the secretsFile permissions. It might make sense to add it to the LoadCredential option too, so that it can be owned and readable only by root.

m1cr0man · 2021-01-26T08:57:22Z

nixos/modules/services/web-servers/pomerium.nix

+      };
+    };
+
+    # postRun hooks on cert renew can't be used to restart Nginx since renewal


Says "Nginx" here ;)

m1cr0man · 2021-01-26T09:00:11Z

nixos/modules/services/web-servers/pomerium.nix

+      type = format.type;
+    };
+
+    secretsFile = mkOption {


With the use of DynamicUser in the systemd config, what would be the proper way to secure a secrets file on the local filesystem from other users?

contrun · 2021-01-30T08:16:17Z

Was just about to try out pomerium. This looks great to me. Thank you.

contrun · 2021-03-02T15:24:16Z

I think this pr is ready to be merged. @lukegb can you please update pomerium to v0.13.2 ?

contrun

@lukegb I just tried pomerium 0.13.3. The proposed changes build on my machine. I also tried the test case. It works great. Thank you for your contribution.

pkgs/servers/http/pomerium/default.nix

Bump pomerium to v0.13.3. Co-authored-by: contrun <uuuuuu@protonmail.com>

contrun

Thanks

SuperSandro2000 · 2021-03-31T15:53:02Z

pkgs/servers/http/pomerium/default.nix

+    };
+    varFlags = concatStringsSep " " (mapAttrsToList (name: value: "-X github.com/pomerium/pomerium/internal/version.${name}=${value}") setVars);
+  in [
+    "-ldflags=${varFlags}"


Missing -s -w.

Doesn't seem to be set in pkgs/development/go-modules/generic/default.nix as a default, so it's not like we're overriding it off, I think?

It probably does not work for every package. Should be set anyway when specifying ldflags.

Maybe does not work with all packages. Should be set anyway when specifying ldflags.

ofborg bot added 6.topic: nixos 8.has: module (update) labels Jan 8, 2021

lukegb force-pushed the pomerium branch from 61b75a9 to 73eaf3d Compare January 8, 2021 03:38

aanderse reviewed Jan 8, 2021

View reviewed changes

lukegb force-pushed the pomerium branch 5 times, most recently from e3c0b5e to add12a3 Compare January 9, 2021 00:46

lukegb requested a review from aanderse January 9, 2021 00:48

lukegb marked this pull request as ready for review January 9, 2021 00:51

ofborg bot added the 8.has: package (new) label Jan 9, 2021

ofborg bot requested a review from kalbasit January 9, 2021 01:13

ofborg bot added 11.by: package-maintainer 10.rebuild-darwin: 11-100 10.rebuild-linux: 11-100 labels Jan 9, 2021

lukegb force-pushed the pomerium branch from add12a3 to afb36eb Compare January 12, 2021 20:31

lukegb marked this pull request as draft January 13, 2021 00:14

lukegb force-pushed the pomerium branch from afb36eb to 9b85307 Compare January 13, 2021 02:15

lukegb force-pushed the pomerium branch from 9b85307 to 2e015e6 Compare January 19, 2021 16:34

lukegb marked this pull request as ready for review January 19, 2021 16:35

ofborg bot added 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 and removed 10.rebuild-darwin: 11-100 10.rebuild-linux: 11-100 labels Jan 19, 2021

lukegb force-pushed the pomerium branch from 2e015e6 to 7c14591 Compare January 24, 2021 16:25

m1cr0man approved these changes Jan 26, 2021

View reviewed changes

contrun suggested changes Mar 23, 2021

View reviewed changes

pkgs/servers/http/pomerium/default.nix Outdated Show resolved Hide resolved

pkgs/servers/http/pomerium/default.nix Outdated Show resolved Hide resolved

pkgs/servers/http/pomerium/default.nix Outdated Show resolved Hide resolved

lukegb changed the title ~~pomerium: init at 0.11.1~~ pomerium: init at 0.13.3 Mar 29, 2021

lukegb and others added 5 commits March 29, 2021 10:41

pomerium: init at 0.11.1

8100088

nixos/pomerium: init

cb2f1df

nixos/tests/pomerium: init

309e836

envoy, pomerium: add Pomerium NixOS test to passthru.tests

f081b0c

pomerium: 0.11.1 -> 0.13.3

d4eb533

Bump pomerium to v0.13.3. Co-authored-by: contrun <uuuuuu@protonmail.com>

lukegb force-pushed the pomerium branch from c23634c to d4eb533 Compare March 29, 2021 10:42

contrun approved these changes Mar 29, 2021

View reviewed changes

adisbladis merged commit f5a14a3 into NixOS:master Mar 31, 2021

SuperSandro2000 reviewed Mar 31, 2021

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

pomerium: init at 0.13.3 #108745

pomerium: init at 0.13.3 #108745

lukegb commented Jan 8, 2021 •

edited

aanderse left a comment

lukegb commented Jan 9, 2021

aanderse commented Jan 16, 2021

lukegb commented Jan 16, 2021

lukegb commented Jan 19, 2021

aanderse commented Jan 22, 2021

lukegb commented Jan 24, 2021

aanderse commented Jan 26, 2021

m1cr0man left a comment

m1cr0man Jan 26, 2021

m1cr0man Jan 26, 2021

contrun commented Jan 30, 2021

contrun commented Mar 2, 2021

contrun left a comment

contrun left a comment

SuperSandro2000 Mar 31, 2021

lukegb Mar 31, 2021

SuperSandro2000 Mar 31, 2021

SuperSandro2000 Mar 31, 2021

pomerium: init at 0.13.3 #108745

pomerium: init at 0.13.3 #108745

Conversation

lukegb commented Jan 8, 2021 • edited

Motivation for this change

Things done

aanderse left a comment

Choose a reason for hiding this comment

lukegb commented Jan 9, 2021

aanderse commented Jan 16, 2021

lukegb commented Jan 16, 2021

lukegb commented Jan 19, 2021

aanderse commented Jan 22, 2021

lukegb commented Jan 24, 2021

aanderse commented Jan 26, 2021

m1cr0man left a comment

Choose a reason for hiding this comment

m1cr0man Jan 26, 2021

Choose a reason for hiding this comment

m1cr0man Jan 26, 2021

Choose a reason for hiding this comment

contrun commented Jan 30, 2021

contrun commented Mar 2, 2021

contrun left a comment

Choose a reason for hiding this comment

contrun left a comment

Choose a reason for hiding this comment

SuperSandro2000 Mar 31, 2021

Choose a reason for hiding this comment

lukegb Mar 31, 2021

Choose a reason for hiding this comment

SuperSandro2000 Mar 31, 2021

Choose a reason for hiding this comment

SuperSandro2000 Mar 31, 2021

Choose a reason for hiding this comment

lukegb commented Jan 8, 2021 •

edited