nixos-config/nix/verify/default.nix

93 lines
2.8 KiB
Nix
Raw Normal View History

{ self, ... }:
{
imports = [ ];
2024-09-13 09:36:17 +02:00
flake.nixosModules.verify = {
imports = [
./modules/closedPorts.nix
2024-09-16 02:06:03 +02:00
./modules/http.nix
./modules/localCommands.nix
];
};
perSystem =
{
pkgs,
self',
lib,
...
}:
with lib;
{
2024-09-13 09:36:17 +02:00
apps.verify = {
type = "app";
program =
let
nixosConfigurationsToVerify = filterAttrs (
machine: configuration: builtins.hasAttr "verify" configuration.options
) self.nixosConfigurations;
2024-09-15 01:32:21 +02:00
verifyLocalCommands =
nixosConfiguration:
let
localCommands = nixosConfiguration.options.verify.localCommands.value;
commands = mapAttrsToList (
serviceName: serviceCommand:
let
# todo handle exit code and stderr and such properly
script = pkgs.writers.writeBash "${serviceName}" serviceCommand;
2024-09-16 03:58:27 +02:00
#title = if title != null then title else "verify service ${serviceName}";
title = "verify service ${serviceName}";
2024-09-15 01:32:21 +02:00
in
''
2024-09-16 03:58:27 +02:00
echo "${title}"
2024-09-15 01:32:21 +02:00
${script}
''
) localCommands;
in
flatten commands;
verifyClosedCommands =
nixosConfiguration:
let
command = serviceName: interfaceName: host: ports: ''
echo "verify ${interfaceName} ports are closed for ${serviceName}"
${pkgs.rustscan}/bin/rustscan \
--ports ${concatStringsSep "," (map toString ports)} \
--addresses ${host} \
--greppable
'';
interfaces = nixosConfiguration.options.verify.closed.value;
interfaceCommands = mapAttrsToList (
interfaceName: interfaceConfiguration:
mapAttrsToList (
serviceName: servicePorts:
command serviceName interfaceName interfaceConfiguration.host servicePorts
) interfaceConfiguration.ports
) interfaces;
in
flatten interfaceCommands;
verify = machineName: nixosConfiguration: ''
echo "${machineName}" | ${pkgs.boxes}/bin/boxes -d ansi
${concatStringsSep "\n" (verifyClosedCommands nixosConfiguration)}
2024-09-15 01:32:21 +02:00
${concatStringsSep "\n" (verifyLocalCommands nixosConfiguration)}
'';
allCommands = concatStringsSep "\n\n" (mapAttrsToList verify nixosConfigurationsToVerify);
in
pkgs.writers.writeBashBin "verify" allCommands;
};
};
}