From d28d28d6eed0143ba3d2e662dbad16305bae0cdf Mon Sep 17 00:00:00 2001
From: Daniel Kempkens <daniel+git@kempkens.io>
Date: Tue, 14 Feb 2023 11:04:10 +0100
Subject: [PATCH] nitter: Use package

---
 agenix/hosts/sail/config.nix        |   1 +
 agenix/hosts/sail/nitter/config.age | Bin 2157 -> 2134 bytes
 system/nixos/nitter.nix             |  81 ++++++++++++++++++----------
 3 files changed, 53 insertions(+), 29 deletions(-)

diff --git a/agenix/hosts/sail/config.nix b/agenix/hosts/sail/config.nix
index e3b1b0f..1049e46 100644
--- a/agenix/hosts/sail/config.nix
+++ b/agenix/hosts/sail/config.nix
@@ -68,6 +68,7 @@
 
     nitter-config = {
       file = ./nitter/config.age;
+      mode = "444";
     };
 
     nitter-auth = {
diff --git a/agenix/hosts/sail/nitter/config.age b/agenix/hosts/sail/nitter/config.age
index ddbcc9c6e5cc08809af6a16417e7b3d41885e3e4..f3a14d072c7fce6b84238a8bf84d5f105836ebf1 100644
GIT binary patch
delta 2113
zcmV-H2)_625Y`ZoEPrBlHd=I8SZhjURCP>LLo#SaNkd6zX<;&KF*#LlP)#sHOkzoD
zdQoX@MG8<>HCbaaF;+utD|A<OLsDXEGg2~YNk=eqb96{mWmQmkF)uZ9Q)g>tK?*HC
zAaiqQEoEdfH8n9gAWmXdG-!7qdQN9&bx3bcPgpN<W_fI9Gk;idN@RISH#S#kX?8>}
zS#K*;L~%@dD@;Xe3QR*-bZ2QcP(@65F;-$TP&YYgO+s%pYj03SFmO>zWJgIfNi{QB
zMrKQQ3N1b$dUk6{E@Ulda%Ew2WePKMR%cCmadk#FFgY<=H8u(@EiE8vD{D!3Ra#?I
zM|NyYVpvHsMt?|iP(xxkF?mCHbZ$pdcUVDGZ(((JZcS?n=45D(=k*;gf~-^khm-Ta
zYnA*~qvn!>I*@kd1t&IFxIp@gO%AE_vuSp9+>mD!b^aCFip9mFG6Y24F8bSxj#~z#
zHSKe%w7MaCv2KllA(G>|8Z{%pSEX5-LM=B=(vDp>D}T@!`cqExe@fT~l6nWsExZKZ
z-|}#A0D46g9a+RQ2N$gQum=wYF*WMM%U`PmU{>B33(Io@nujo{KcS*4Miy+7iWCi7
zc?IVNn#5nQ&|KD)eDacpP`&4r>7Kml-{3nZjqU;s-O2Ig$f43T=qufpG1g-RMq?w)
zJTj7rwtr?Xqoh9>VuovLbQVmsY#G4c!TJ(+=_?yJ_C9uA1Z`K)H*iHtOXqn@@P?{$
z8ZLOdy!z$&$*D}Kr}k29Z$ODD5r02qSnzrq`Yw}|?B>E*__EW7Nz3IJR^;jGb!3yV
zjpyB<2>Y?5X`%#u&PGEIAxDeQgqIBf5DbR}+J6OJt??NuU>dpec(7|LambT{=#48;
zmE(QlyjTwz&yJ5Rxf6lM$Hrygcuzh-QZ!2E>x}P=G&9j%n%T2ab0IS$Ez6*;Ia9M5
zXLD_w8AYNl;0pFBA7%T!25w@XL9Bq&<?dW$9^tK}>DonH<DEsgBx@6Q>~6^9i|(t;
zsDCNZJigUF6IUH`e;mGOdwA50%A*RMhkpr^AMK4nCS{+qQ|ouv3@S#^n$4=uq1DZ&
z<H>5CI$RzaA!rq5%_7!+5zPh7jF=Bi5v*m{&QVx_9aAi~t}viRNmA9MR1GnAAcdF~
zoNm|{Z^CFn<m4F$0qZ^6c;l8wX>T6PM1M2i;K-g2gTt8I752l%KTcGB(nq&sbAq;%
zQAE0PoIlT5;LalNIlaDF++^o%a!d+pA)v!IZ^OMLR2?3YoM?Oq`)+uHrZ1RDR8ZD2
zbF$_pa9@c4^J5lTZsk<Orcz?7oK7(>nLZY~Y^6Bri^BQ(ZroVhlY;e{1uZ6fh<}hP
z26o7*IL}6H!vFr_#yqvg9QGDck&$~L_X)sM4(R%obcPyU&(kw;eq5vjvK&ayx!R#z
zioQ&MQEFRbY9UjfRX2aFD6vE9@g1ODC?Qh*R{ldxJH0N$MZ<+^%-F&Bff_Hnz%rQq
z&F)}N<Jjz=0x3Z5gmrMF1t90ho`3!itg(8e6R{g_G48pb#7XdUjk(y9V@oREz2bNp
zZ3Lb~T~>sS>D4buREI^SDwtFTCkh9(IqKPFuqO3!cbFDz^0f)JVOxY9;1S3Vpd-uZ
zTXF3tBCLv^whIEG0r>12k2X>r2Xbe^6ZbT_qu6cg;%8HA@O2A4@QraF6@Qm2g{9sP
z1&@A=0R{z`mWQ{7X8Kb$Q>vHq7rq&IDo>Sg#=S{zjJPHpwxWBnB(*K`l>1+n6rg%x
zRn03`*+s9{lk8qT&5>NiX3Q#<AjVH<>@C>}UOP0?nO?V>6DO>KIc{u>9l2m5Vtk-^
zvvsO3+V@@^_p2Mski7JTqkkOs2LU?d=4Gv5fzL04Jh0dTuQ6r0gTbPAFKnwmuf5KN
z1Y2s#80A|~mRVWw{w^Scfv}<l=;}mgxSm!CRogtfep7}@NX;S@MTdyPp~i9uc;cr1
zkr(2PT<1&cvV0K<l=Zco5!s-9F%VFF<&J$(hztz~IXYV=P-$bppnq9{92RvU43cCz
zmq5-u>d~c#Ff0Mw*VM9TK!xM7_}^$4mA`&GyrFy<^){3eKFU|4d<NYsL#$Y9o>_9y
z16xDqIH%hlNf_)qfi1bz>;z)B^qxTgo)kOFhQBX3W#=CmMcb2r@lWxtfIjCMTvXQ*
zRiX78=4+XcGfSu3#(!Su3~RvHlO!!N^treY!5T=ms$H|_<@2}Mufg7!V*1SE*$(h6
z+D|B9s)&C~^0qj+KC_zhU8L~%QIW_;nyvN{Wc7BG(2Gtj%`iT$h?}32D4NJ~^?qLw
z-`CbVR0!F&3LPUxfxZ26vUvAcI(JGaA{kP)86xe}ZDq9rd4HD1HS@GTHpY^6%1{&l
z!hMi}D-TT9=dX4eq<q8m3JF}G!r0n`dL_J|@nvN@S^6SmxccO9sdQe|%(QFAMz$0<
zZXvV^xzbt_q@QN_X3M<0*)KH7p62;Zlog4G*gxHy`QR{p4Ee53z%XD(+;CI*>@+Mx
zCBwr;`OLVRY=1F?Cu8^<v6)R5-Sl*N(Q;4-Q-%8a8(6vMVciFEG3-tn94iwy67E^C
zvQL6857kZ{2B5crKhPuwhzF(!PbgZse0;lHn0Oq%8wD_G@@S^2|4k$KK0NSt%kT3J
z>gnQo)Zv%;_T(pwqd!2gCCC`mrH8*12=vtTH66wg$vPqDAVtZ?g?U(pqeH~nn^z7c
r02?QVeH3Wi8%@!Cp7uUM#Ub?izDMCeO0!a!3Gr(*HQnnm+05_(Q6c1d

delta 2136
zcmV-e2&ebf5bY3<EPq2*L}o>KF;P-Qac($bFjZtlXfJqaSZQoDcV|ImOEq#tL}OP&
zbYU}WSqfQJOmcT~Y++?%QCdY*Y(g(;IZ#+~WoAZHaWimQFH$*lGcb8MHA`hnI0`L3
zAaiqQEoEdfH8n9gAWmXdG-!7qPB>&YH#jeGLsBwjHep$1W`9#+S29mDIczp_ZE09C
zIAT|2NNY)0OEg$83SmVrSW-87Zd7biMKf!4Z$(9Uc63>8MPqqlFl28vFHmJ`bWb=`
zIZkC&3N1b$U_3@&X=N>Ea%Ew2WgtW;Mq^ndAVEiSJv}NQCwF@~ATVSrPIYJ{Itnsb
zcx-u7Gjv8+P=9m^EiEk|WO+7AHZ^%hR!?DdLr^PHa#J#FWq3$vaaBhvHZV_NVRblc
zcy=>OR&-GciRZV_B;~&@KmU0WG{o?o^b?CqQ?+cyY;Spg_ZcUH1`82!6RAB7aukz9
zIDKuKGvz~S_<oM<ZMD|#?U5j5AhDD>-m?`n<5J!3ynks`>vqHM0KyXLyQt6E;2K6t
zHg(h#Bsq^ygF&Bx&%bDk#8QFj9XaO=H$bl~Zttd$b>*{Dp0++vWSL};$$~s)%c^m6
zb>MAK9^BB{x_v9FqM%}Z9D8|=X5^{;vZvAv&dXGHw?=pUB=2^2S=RB>AK>tdZTt3r
z;}{BJf`31<eZ!2E|0QgO^XwlKv|(K#@`Az5z6{F4O{<DY((Ou$j0`^Kv0X9M0AOyu
zrp@5=r(|E>x<4bsph_KY&sf$U|6~LkYqTZ6#ZKl%U;WrN+2BLz-@(M9s3=@<Y@<y|
z1w$w3X3(S`4aMjBO^mM!L%V@Uium{_?`|%QZGTqE6Y>s*+n4|Hrcmb>O?fl@2^z;i
z@Jz3(H0GVmJZ_*emGs>wSxZT^xqxOs-yvn1?IhKn1Na2r?{5#taTOTl<KWix7w4jL
zXhw8!GaHu*oCl6ap{Db_RI}7}`4}G$B2OA%+sG8P-1QBO&)*}`WDxLAzo=A(yMvRe
z<$oX&cT{_Hc6E$*2)8gotYUB)p?CnxW*RAxE{4yo$%$Qna0bmEmAjVRd5A#r7rV4U
z8XM|{Pw9;0MFPHmu){v3!?&T<gm+Jt%P9q^LmM}kb1y<}TL8pHWj3O+r*+c-iVW4}
z$@D`EA0TzVoTF{RvE&6s?hr%E2+%|0|9`)-7}&nh5$h1!3m@(2w^C`fqQr+qX(foW
zz*bn|M?wY6{8E^havkjsaVs>sR2VzoU1PZn>9k*(1&gXwzStHWbS(oJtS3>EG6t9_
zFzbgB_iz{hQDk6I5BojRF%w0$`vEnrKDBJxSlGk+r&>lQD}~2A)S*(_04?W5kbfx2
zun3qiE6iqRsqU8aM&r)$tBYa^j2=Cfxcb^v#A)9*<xh8${K~cU@084l!`g8*Lo}w!
z(oPB?1^CSBcNl51NvWb>h2<w0IJ~xl;|#?!(n`48^(ulNZ;vrc56kmbDY-#|bhS1V
zDdU(^%Fgx|g`X7f?2J|&oOc6LWPd!@$=~Bs_*FJo>7~!ZC8nZi_(<`liL{j6>4(nA
z6Ih0z^$u_^2&uDbGw_NsmLD7ytLB*ovom~U<B(@|Qs&A)UvOUl5*Ir*zgHU~8_=XH
z>GxBtU0pGJnB0N#ps7-Pc&ei@N2;}UiTKb!?p}fYA>GEbYKaP>04^6rX@BYi3M>a?
z?eh3ruXFWIUJ)o07|IC!*AxSVdSmnQQ-Ztf-|@rG$N6C#1Q5)%c7^p!_oMY@+NE+z
zY@7Y16LN_`=?Vl68A@=gbdfWp&RL@hDC1WOALgC|^<G4NNlxs{Sv8o_97lcBK*u@0
z{Cj=v_(62h0$^8;juC7cHh-;Zce5b)6C`>N*C255^#bE=K&97!<X-vQ$;?s;u>z}^
zM3a*KDm;>YMI-eu%)tCTUS`Re6mYy80H!E4z7YQj2pUVoS~7}Vnp+deU|m`|MAvqt
zKfEiPh3CJ~0rSF%pF5vMcH8RlNFk#vDO;jo3!*wO#)gJVs$nXu&VM)d-S8=DlEI!V
z$sz5WCY5zpG_V1y=S-mE!;~|Eq=%dHMl44)Mv>PUh5p>6S}6n5PjGG6eKJB9Q1kAF
zeW7s@=L1TgyYass<syMt?W+>i!u9JzC-ih}kYsmgc5&h?e5AKM#t(MWZWCPNX%+dU
zX+>o0+17lq^ZxKCnSTI%k)b12HC1CQP8VoKJUnNd4vtG1zhs~JIB=A0!PZ1R9p!_1
z+|izSo)#Gt!L;8U3$4oGCP*|&>_8qlJ6u6$4q_n~d_qZ6xb^{7gL<Nh`NM1?Ja5W6
za`-x=Gn-tPz5(i<di@!g81;g`1@S*d$4abXJLe$6vsZJGR)2iMRg&jq9c@3B$3!Rr
zo~#5aMo|qoRZAiEqv5YueCcn~PihX+S)rv|qn?c>;0gcou@A0tJ*T)(Q7<%`2p7*i
zj4=7E{2-5d*D>1Z=Pc&SgHFk(CPa7>w-=A+sCAK#__S_2#l@Y=!J3f|oE&w}hAHVQ
z^&tFJzA(&;sDJWgyQvDVE_^aOx&UghJ^Xo>)>k)&l?)YShK|QwI|v*@d3ry7A@9Di
z(eH@mq9~>$CBbrh?oSV{k!Mt`xA&_unI$PI8J3`vR6matMWV&J=IO^6Pumt@LAA(p
zdF<s0Z5hV^y5Mv_^!0Qg7ttOtadlj@_Hy!;hgm2L;!&Pxn4{XRJdzQKAIz5rw6MQ_
zQ1PnKtxLYl8ZL|$q+sJ*`!Z2I=sEu7J1WD!@4v-wCg3A}WX4D%gk2=NrP@}3`%l~(
Ouspt^k2eX)U2^XmnebBp

diff --git a/system/nixos/nitter.nix b/system/nixos/nitter.nix
index 3af5125..7463adb 100644
--- a/system/nixos/nitter.nix
+++ b/system/nixos/nitter.nix
@@ -1,31 +1,55 @@
-{ config, ... }:
+{ pkgs, config, ... }:
 
 let
+  nitter-pkg = pkgs.nitter-unstable;
+
   proxy-no-auth = {
     recommendedProxySettings = true;
     proxyPass = "http://127.0.0.1:8001";
   };
 in
 {
-  virtualisation.arion.projects.nitter.settings = {
-    services = {
-      nitter = {
-        service = {
-          image = "zedeus/nitter:latest";
-          container_name = "nitter";
-          restart = "unless-stopped";
-          ports = [ "127.0.0.1:8001:8080" ];
-          environment = {
-            "TZ" = "Europe/Berlin";
-          };
-          volumes = [
-            "${config.age.secrets.nitter-config.path}:/src/nitter.conf:ro"
-          ];
-          labels = {
-            "com.centurylinklabs.watchtower.enable" = "true";
-          };
-        };
-      };
+  # Based on: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/misc/nitter.nix
+
+  systemd.services.nitter = {
+    description = "Nitter (An alternative Twitter front-end)";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      DynamicUser = true;
+      StateDirectory = "nitter";
+      Environment = [ "NITTER_CONF_FILE=${config.age.secrets.nitter-config.path}" ];
+      # Some parts of Nitter expect `public` folder in working directory,
+      # see https://github.com/zedeus/nitter/issues/414
+      WorkingDirectory = "${nitter-pkg}/share/nitter";
+      ExecStart = "${nitter-pkg}/bin/nitter";
+      Restart = "on-failure";
+      RestartSec = "5s";
+      # Hardening
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateDevices = true;
+      # A private user cannot have process capabilities on the host's user
+      # namespace and thus CAP_NET_BIND_SERVICE has no effect.
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+      UMask = "0077";
     };
   };
 
@@ -39,23 +63,22 @@ in
         }
       ];
 
+      root = "${nitter-pkg}/share/nitter/public/";
       forceSSL = false;
       enableACME = false;
 
       locations."/" = {
-        basicAuthFile = config.age.secrets.nitter-auth.path;
+        tryFiles = "$uri @proxy";
+      };
 
+      locations."/pic/" = proxy-no-auth;
+      locations."/video/" = proxy-no-auth;
+
+      locations."@proxy" = {
+        basicAuthFile = config.age.secrets.nitter-auth.path;
         recommendedProxySettings = true;
         proxyPass = "http://127.0.0.1:8001";
       };
-
-      # Disable auth for certain paths
-      locations."/pic/" = proxy-no-auth;
-      locations."/video/" = proxy-no-auth;
-      locations."/favicon.ico" = proxy-no-auth;
-      locations."/favicon-32x32.png" = proxy-no-auth;
-      locations."/favicon-16x16.png" = proxy-no-auth;
-      locations."/apple-touch-icon.png" = proxy-no-auth;
     };
   };
 }