From 2675f853613a73b4ebc6759eaa786a5098200080 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Thu, 22 Aug 2024 23:44:40 +0200 Subject: [PATCH 1/5] nixos: services: add pdf-edit --- modules/nixos/services/default.nix | 1 + modules/nixos/services/pdf-edit/default.nix | 49 +++++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 modules/nixos/services/pdf-edit/default.nix diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix index 60b2478..fb474de 100644 --- a/modules/nixos/services/default.nix +++ b/modules/nixos/services/default.nix @@ -26,6 +26,7 @@ ./nginx ./nix-cache ./paperless + ./pdf-edit ./pirate ./podgrab ./postgresql diff --git a/modules/nixos/services/pdf-edit/default.nix b/modules/nixos/services/pdf-edit/default.nix new file mode 100644 index 0000000..8771371 --- /dev/null +++ b/modules/nixos/services/pdf-edit/default.nix @@ -0,0 +1,49 @@ +{ config, lib, ... }: +let + cfg = config.my.services.pdf-edit; +in +{ + options.my.services.pdf-edit = with lib; { + enable = mkEnableOption "PDF edition service"; + + port = mkOption { + type = types.port; + default = 8089; + example = 8080; + description = "Internal port for webui"; + }; + + loginFile = mkOption { + type = types.str; + example = "/run/secrets/pdf-edit/login.env"; + description = '' + `SECURITY_INITIALLOGIN_USERNAME` and `SECURITY_INITIALLOGIN_PASSWORD` + defined in the format of 'EnvironmentFile' (see `systemd.exec(5)`). + ''; + }; + }; + + config = lib.mkIf cfg.enable { + services.stirling-pdf = lib.mkIf cfg.enable { + enable = true; + + environment = { + SERVER_PORT = cfg.port; + SECURITY_CSRFDISABLED = "false"; + + SYSTEM_SHOWUPDATE = "false"; # We don't care about update notifications + INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "true"; # Installed by the module + + SECURITY_ENABLELOGIN = "true"; + }; + + environmentFiles = [ cfg.loginFile ]; + }; + + my.services.nginx.virtualHosts = { + pdf-edit = { + inherit (cfg) port; + }; + }; + }; +} From bcf9c24c16ec7d449495d9de9885f0cea81ccc52 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Thu, 22 Aug 2024 23:45:16 +0200 Subject: [PATCH 2/5] hosts: nixos: porthos: secrets: add pdf-edit --- hosts/nixos/porthos/secrets/pdf-edit/login.age | 8 ++++++++ hosts/nixos/porthos/secrets/secrets.nix | 2 ++ 2 files changed, 10 insertions(+) create mode 100644 hosts/nixos/porthos/secrets/pdf-edit/login.age diff --git a/hosts/nixos/porthos/secrets/pdf-edit/login.age b/hosts/nixos/porthos/secrets/pdf-edit/login.age new file mode 100644 index 0000000..7f13f88 --- /dev/null +++ b/hosts/nixos/porthos/secrets/pdf-edit/login.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 cKojmg VYlHgHSLpfKb5bn1XA3aCpfX7M23DgbraLxxOfo9PDk +Rj+mDvAsWX3WwpuhTrOubmo17j/aud5+P87df5bosBA +-> ssh-ed25519 jPowng o9ZFaYrITZ6DjWw07Vk/+TkuU187/ytlEK4sw7G32G4 +zmxlpDvDDEgQFqBVARXeX1ABhvfJ4uAHfa6mIxXzjAY +--- k/d9FWW8/OSo8EllwOBV74pZyX918u54jEljGk3ATUc +4+2{hE7!ҭGA`ׁ_@ߗR_6JL4v,6%#^  BOF|7ܽL]jR +B۾as]xS pbo#J1Q=t}5>O{+. M"7ey \ No newline at end of file diff --git a/hosts/nixos/porthos/secrets/secrets.nix b/hosts/nixos/porthos/secrets/secrets.nix index a9b9c51..a8a9819 100644 --- a/hosts/nixos/porthos/secrets/secrets.nix +++ b/hosts/nixos/porthos/secrets/secrets.nix @@ -77,6 +77,8 @@ in "paperless/password.age".publicKeys = all; "paperless/secret-key.age".publicKeys = all; + "pdf-edit/login.age".publicKeys = all; + "podgrab/password.age".publicKeys = all; "pyload/credentials.age".publicKeys = all; From 1fc87907908f64e0fddfeced98e0c6790e01c78f Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Thu, 22 Aug 2024 23:46:25 +0200 Subject: [PATCH 3/5] hosts: nixos: porthos: services: enable pdf-edit --- hosts/nixos/porthos/services.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix index 23901f7..2555bee 100644 --- a/hosts/nixos/porthos/services.nix +++ b/hosts/nixos/porthos/services.nix @@ -127,6 +127,11 @@ in passwordFile = secrets."paperless/password".path; secretKeyFile = secrets."paperless/secret-key".path; }; + # Sometimes, editing PDFs is useful + pdf-edit = { + enable = true; + loginFile = secrets."stirling-pdf/login".path; + }; # The whole *arr software suite pirate = { enable = true; From 771da4b1376b9900fa0e959b27971e3c56f28eaf Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Thu, 22 Aug 2024 23:56:53 +0200 Subject: [PATCH 4/5] WIP: FINISH SETTING UP FAIL2BAN --- modules/nixos/services/pdf-edit/default.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/modules/nixos/services/pdf-edit/default.nix b/modules/nixos/services/pdf-edit/default.nix index 8771371..e5ea5b3 100644 --- a/modules/nixos/services/pdf-edit/default.nix +++ b/modules/nixos/services/pdf-edit/default.nix @@ -45,5 +45,21 @@ in inherit (cfg) port; }; }; + + services.fail2ban.jails = { + stirling-pdf = '' + enabled = true + filter = stirling-pdf + port = http,https + ''; + }; + + environment.etc = { + "fail2ban/filter.d/stirling-pdf.conf".text = '' + [Definition] + failregex = ^.*Failed login attempt from IP: $ + journalmatch = _SYSTEMD_UNIT=stirling-pdf.service + ''; + }; }; } From 0b70da3ac91d326f1847aef41ddb8a3a2a897dd5 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Thu, 22 Aug 2024 23:59:29 +0200 Subject: [PATCH 5/5] fixup! hosts: nixos: porthos: services: enable pdf-edit --- hosts/nixos/porthos/services.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/nixos/porthos/services.nix b/hosts/nixos/porthos/services.nix index 2555bee..0d10e65 100644 --- a/hosts/nixos/porthos/services.nix +++ b/hosts/nixos/porthos/services.nix @@ -130,7 +130,7 @@ in # Sometimes, editing PDFs is useful pdf-edit = { enable = true; - loginFile = secrets."stirling-pdf/login".path; + loginFile = secrets."pdf-edit/login".path; }; # The whole *arr software suite pirate = {