invidious: update settings

flake.lock

@@ -236,11 +236,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703674883,
-        "narHash": "sha256-Jna6MOmLdfgot+AopHv28L+wpwVDfaiafLtO7E4bkj0=",
+        "lastModified": 1703754036,
+        "narHash": "sha256-JpJdcj9Tg4lMuYikXDpajA8wOp+rHyn9RD2rKBEM4cQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "458544594ba7f0333cf5718045ee7a8eaf5de433",
+        "rev": "c24c298562fe41b39909f632c5a7151bbf6b4628",
         "type": "github"
       },
       "original": {
@@ -304,11 +304,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703728877,
-        "narHash": "sha256-PNoKunIsfKJyJWTzEM7stL2Zu5m19JgbajjUYMtsvP8=",
+        "lastModified": 1703766857,
+        "narHash": "sha256-PAUS+G8gHypPACYo74zDFEwGm/CQGVOryGerA0ayMWs=",
         "ref": "refs/heads/master",
-        "rev": "f4ebb80e539ae4a22dc724cc5254b35dccd9369a",
-        "revCount": 648,
+        "rev": "89030cc0dd349a81a2c9129fa08d7cafd824414b",
+        "revCount": 649,
         "type": "git",
         "url": "https://git.kempkens.io/daniel/nix-overlay"
       },

system/hosts/tanker.nix

@@ -41,7 +41,7 @@ in
 
     ../nixos/invidious.nix
 
-    (import ../nixos/libreddit.nix (args // { inherit secret; }))
+    (import ../nixos/redlib.nix (args // { inherit secret; }))
 
     ../nixos/linkding.nix
 

system/nixos/invidious.nix

@@ -8,6 +8,7 @@ in
     enable = true;
 
     domain = fqdn;
+    address = "127.0.0.1";
     port = 8007;
 
     database = {
@@ -20,7 +21,6 @@ in
         dbname = "invidious";
       };
 
-      host_binding = "127.0.0.1";
       external_port = 443;
       https_only = true;
 

system/nixos/libreddit.nix

@@ -1,48 +0,0 @@
-{ secret, ... }:
-
-{
-  services.libreddit = {
-    enable = true;
-
-    address = "127.0.0.1";
-    port = 8002;
-  };
-
-  services.nginx.virtualHosts."${secret.nginx.hostnames.libreddit}" = {
-    # listen = [
-    #   {
-    #     addr = "100.64.10.2";
-    #     port = 443;
-    #     ssl = true;
-    #     extraParameters = [
-    #       "fastopen=63"
-    #       "backlog=1023"
-    #       "deferred"
-    #     ];
-    #   }
-    #
-    #   {
-    #     addr = "[fd7a:115c:a1e0:1010::2]";
-    #     port = 443;
-    #     ssl = true;
-    #     extraParameters = [
-    #       "fastopen=63"
-    #       "backlog=1023"
-    #     ];
-    #   }
-    # ];
-
-    listenAddresses = [ "100.64.10.2" "[fd7a:115c:a1e0:1010::2]" ];
-
-    quic = true;
-    http3 = true;
-
-    onlySSL = true;
-    useACMEHost = "daniel.sx";
-
-    locations."/" = {
-      recommendedProxySettings = true;
-      proxyPass = "http://127.0.0.1:8002";
-    };
-  };
-}

system/nixos/redlib.nix

@@ -0,0 +1,85 @@
+{ pkgs, lib, secret, ... }:
+
+{
+  systemd.services.redlib =
+    let
+      args = lib.concatStringsSep " " ([
+        "--port 8002"
+        "--address 127.0.0.1"
+      ]);
+    in
+    {
+      description = "Private front-end for Reddit";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${pkgs.redlib}/bin/redlib ${args}";
+        Restart = "on-failure";
+        RestartSec = "2s";
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        # A private user cannot have process capabilities on the host's user
+        # namespace and thus CAP_NET_BIND_SERVICE has no effect.
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        UMask = "0077";
+      };
+    };
+
+  services.nginx.virtualHosts."${secret.nginx.hostnames.libreddit}" = {
+    # listen = [
+    #   {
+    #     addr = "100.64.10.2";
+    #     port = 443;
+    #     ssl = true;
+    #     extraParameters = [
+    #       "fastopen=63"
+    #       "backlog=1023"
+    #       "deferred"
+    #     ];
+    #   }
+    #
+    #   {
+    #     addr = "[fd7a:115c:a1e0:1010::2]";
+    #     port = 443;
+    #     ssl = true;
+    #     extraParameters = [
+    #       "fastopen=63"
+    #       "backlog=1023"
+    #     ];
+    #   }
+    # ];
+
+    listenAddresses = [ "100.64.10.2" "[fd7a:115c:a1e0:1010::2]" ];
+
+    quic = true;
+    http3 = true;
+
+    onlySSL = true;
+    useACMEHost = "daniel.sx";
+
+    locations."/" = {
+      recommendedProxySettings = true;
+      proxyPass = "http://127.0.0.1:8002";
+    };
+  };
+}