greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
709 Commits 8 Branches 0 Tags 4.1 MiB
de1a7346dc
Commit Graph

21 Commits

Author SHA1 Message Date
Erik Arvstedt
9715134f06
netns: don't repeat cli definitions 
1. Saves some code.
2. Guarantees that the netns and no-netns cli defs are always in sync.
 2020-08-25 11:40:27 +02:00
nixbitcoin
e5e07b91f7
netns-isolation: netns architecture 
- Adds network namespace instantiation and routing architecture.
- netns-isolation disabled by default. Can be enabled with
  configuration.nix FIXME.
- Uses mkMerge to toggle certain options for non netns and netns
  systems.
- Adds security wrapper for netns-exec which allows operator to exec
  with cap_sys_admin
- User can select the 169.254.N.0/24 addressblock netns's are created in.
- nix-bitcoin-services IpAddressAllow is amended with link-local
  addresses
 2020-07-21 09:38:20 +00:00
nixbitcoin
ccc3a70344
service hardening: add more restrictions 
Add RestrictSUIDSGID
Add RemoveIPC
Add RestrictRealtime
Add ProtectHostname
 2020-05-24 11:14:45 +00:00
nixbitcoin
3fbfa98635
service hardening: replace obtuse SystemCallFilter with @system-service 
@system-service whitelist and additional
https://docs-stage.docker.com/engine/security/seccomp/#significant-syscalls-blocked-by-the-default-profile
blacklist.
 2020-05-24 11:14:37 +00:00
nixbitcoin
e34d1c884e
service hardening: Add PrivateUsers 
Exceptions in webindex & onion-chef
 2020-05-22 16:16:19 +00:00
Erik Arvstedt
5f3f362451
lnd: add strict hardening 
Add ProtectSystem=strict, remove PermissionStartOnly.

Extract the section of postStart that needs secrets dir write
access into a separate script with full privileges.

Simplify preStart and fix dataDir quoting.
 2020-05-22 16:13:58 +00:00
nixbitcoin
a040e52854
All modules: ProtectSystem = strict 
Add ReadWritePaths in all modules, except lnd which has ProtectSystem =
full.
 2020-05-22 15:47:01 +00:00
nixbitcoin
81a1c3f908
service hardening: Add CapabilityBoundingSets 
Whitelist with exceptions in webindex and onion-chef
 2020-05-22 11:29:54 +00:00
Erik Arvstedt
f0a36fe0c7
add 'nix-bitcoin-services' option 
1. Makes the content easily accessible for module users
2. Avoids needlessly recalculating the attrset in every client module
 2020-01-12 20:02:00 +01:00
Erik Arvstedt
7aaf30501c
nix-bitcoin-services: simplify formatting 2020-01-09 10:43:30 +01:00
Jonas Nick
5f567ee1ed
Merge #113: Simplify clightning preStart 
67a464d097 Mention problems with hardened kernel and NUCs in README (Jonas Nick)
7771a4c931 Refer to systemd man pages for hardening options (Jonas Nick)
a5e10a82d8 Simplify clightning preStart (Jonas Nick)

Pull request description:

  CC @cypherpunk2140

Top commit has no ACKs.

Tree-SHA512: aa726f29e499cc268b21cac8cd07617be591cfdaa89dd0495cb979ebd3e49cc01164af25924c554429a1d35d14167dea276f7d61877452b69f027143cc3eee97
 2019-08-21 14:58:22 +00:00
Jonas Nick
1c8dadd876
Add allowAnyProtocol option to nix-bitcoin-services 2019-08-19 21:11:08 +00:00
Jonas Nick
7771a4c931
Refer to systemd man pages for hardening options 2019-08-19 20:44:10 +00:00
Ștefan D. Mihăilă
cd722cac1a
Fix identation 2019-08-18 12:53:08 +02:00
nixbitcoin
7416ec4a29
Limit syscalls with Docker whitelist 2019-05-10 12:42:06 +02:00
Jonas Nick
e1ee5023e2
Rename service settings for 'node' to 'nodejs' to avoid confusion 2019-05-03 10:44:16 +00:00
Jonas Nick
469c1de6a9
Fix electrum after disallowing anything but localhost by adding ipv6 local address 2019-04-28 18:54:13 +00:00
Jonas Nick
6f8dac6e07
Restrict namespaces for systemd services by default 2019-04-28 13:15:17 +00:00
Jonas Nick
eaaf8e9aab
Use IPAddress{Allow,Deny} by default for systemd services 2019-04-28 13:15:17 +00:00
Jonas Nick
d9533edad1
Fix memory deny write execute for nodejs services 2019-04-28 13:15:16 +00:00
Jonas Nick
a089d65d25
Move service hardening flags into separate file 2019-04-28 13:15:12 +00:00