1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
|
{ config, pkgs, lib, options, ... }:
let
cfg = config.services.firefox-syncserver;
opt = options.services.firefox-syncserver;
defaultDatabase = "firefox_syncserver";
defaultUser = "firefox-syncserver";
dbIsLocal = cfg.database.host == "localhost";
dbURL = "mysql://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}";
format = pkgs.formats.toml {};
settings = {
human_logs = true;
syncstorage = {
database_url = dbURL;
};
tokenserver = {
node_type = "mysql";
database_url = dbURL;
fxa_email_domain = "api.accounts.firefox.com";
fxa_oauth_server_url = "https://oauth.accounts.firefox.com/v1";
run_migrations = true;
# if JWK caching is not enabled the token server must verify tokens
# using the fxa api, on a thread pool with a static size.
additional_blocking_threads_for_fxa_requests = 10;
} // lib.optionalAttrs cfg.singleNode.enable {
# Single-node mode is likely to be used on small instances with little
# capacity. The default value (0.1) can only ever release capacity when
# accounts are removed if the total capacity is 10 or larger to begin
# with.
# https://github.com/mozilla-services/syncstorage-rs/issues/1313#issuecomment-1145293375
node_capacity_release_rate = 1;
};
};
configFile = format.generate "syncstorage.toml" (lib.recursiveUpdate settings cfg.settings);
setupScript = pkgs.writeShellScript "firefox-syncserver-setup" ''
set -euo pipefail
shopt -s inherit_errexit
schema_configured() {
mysql ${cfg.database.name} -Ne 'SHOW TABLES' | grep -q services
}
update_config() {
mysql ${cfg.database.name} <<"EOF"
BEGIN;
INSERT INTO `services` (`id`, `service`, `pattern`)
VALUES (1, 'sync-1.5', '{node}/1.5/{uid}')
ON DUPLICATE KEY UPDATE service='sync-1.5', pattern='{node}/1.5/{uid}';
INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
`capacity`, `downed`, `backoff`)
VALUES (1, 1, '${cfg.singleNode.url}', ${toString cfg.singleNode.capacity},
0, ${toString cfg.singleNode.capacity}, 0, 0)
ON DUPLICATE KEY UPDATE node = '${cfg.singleNode.url}', capacity=${toString cfg.singleNode.capacity};
COMMIT;
EOF
}
for (( try = 0; try < 60; try++ )); do
if ! schema_configured; then
sleep 2
else
update_config
exit 0
fi
done
echo "Single-node setup failed"
exit 1
'';
in
{
options = {
services.firefox-syncserver = {
enable = lib.mkEnableOption (lib.mdDoc ''
the Firefox Sync storage service.
Out of the box this will not be very useful unless you also configure at least
one service and one nodes by inserting them into the mysql database manually, e.g.
by running
```
INSERT INTO `services` (`id`, `service`, `pattern`) VALUES ('1', 'sync-1.5', '{node}/1.5/{uid}');
INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
`capacity`, `downed`, `backoff`)
VALUES ('1', '1', 'https://mydomain.tld', '1', '0', '10', '0', '0');
```
{option}`${opt.singleNode.enable}` does this automatically when enabled
'');
package = lib.mkOption {
type = lib.types.package;
default = pkgs.syncstorage-rs;
defaultText = lib.literalExpression "pkgs.syncstorage-rs";
description = lib.mdDoc ''
Package to use.
'';
};
database.name = lib.mkOption {
# the mysql module does not allow `-quoting without resorting to shell
# escaping, so we restrict db names for forward compaitiblity should this
# behavior ever change.
type = lib.types.strMatching "[a-z_][a-z0-9_]*";
default = defaultDatabase;
description = lib.mdDoc ''
Database to use for storage. Will be created automatically if it does not exist
and `config.${opt.database.createLocally}` is set.
'';
};
database.user = lib.mkOption {
type = lib.types.str;
default = defaultUser;
description = lib.mdDoc ''
Username for database connections.
'';
};
database.host = lib.mkOption {
type = lib.types.str;
default = "localhost";
description = lib.mdDoc ''
Database host name. `localhost` is treated specially and inserts
systemd dependencies, other hostnames or IP addresses of the local machine do not.
'';
};
database.createLocally = lib.mkOption {
type = lib.types.bool;
default = true;
description = lib.mdDoc ''
Whether to create database and user on the local machine if they do not exist.
This includes enabling unix domain socket authentication for the configured user.
'';
};
logLevel = lib.mkOption {
type = lib.types.str;
default = "error";
description = lib.mdDoc ''
Log level to run with. This can be a simple log level like `error`
or `trace`, or a more complicated logging expression.
'';
};
secrets = lib.mkOption {
type = lib.types.path;
description = lib.mdDoc ''
A file containing the various secrets. Should be in the format expected by systemd's
`EnvironmentFile` directory. Two secrets are currently available:
`SYNC_MASTER_SECRET` and
`SYNC_TOKENSERVER__FXA_METRICS_HASH_SECRET`.
'';
};
singleNode = {
enable = lib.mkEnableOption (lib.mdDoc "auto-configuration for a simple single-node setup");
enableTLS = lib.mkEnableOption (lib.mdDoc "automatic TLS setup");
enableNginx = lib.mkEnableOption (lib.mdDoc "nginx virtualhost definitions");
hostname = lib.mkOption {
type = lib.types.str;
description = lib.mdDoc ''
Host name to use for this service.
'';
};
capacity = lib.mkOption {
type = lib.types.ints.unsigned;
default = 10;
description = lib.mdDoc ''
How many sync accounts are allowed on this server. Setting this value
equal to or less than the number of currently active accounts will
effectively deny service to accounts not yet registered here.
'';
};
url = lib.mkOption {
type = lib.types.str;
default = "${if cfg.singleNode.enableTLS then "https" else "http"}://${cfg.singleNode.hostname}";
defaultText = lib.literalExpression ''
''${if cfg.singleNode.enableTLS then "https" else "http"}://''${config.${opt.singleNode.hostname}}
'';
description = lib.mdDoc ''
URL of the host. If you are not using the automatic webserver proxy setup you will have
to change this setting or your sync server may not be functional.
'';
};
};
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = format.type;
options = {
port = lib.mkOption {
type = lib.types.port;
default = 5000;
description = lib.mdDoc ''
Port to bind to.
'';
};
tokenserver.enabled = lib.mkOption {
type = lib.types.bool;
default = true;
description = lib.mdDoc ''
Whether to enable the token service as well.
'';
};
};
};
default = { };
description = lib.mdDoc ''
Settings for the sync server. These take priority over values computed
from NixOS options.
See the doc comments on the `Settings` structs in
<https://github.com/mozilla-services/syncstorage-rs/blob/master/syncstorage/src/settings.rs>
and
<https://github.com/mozilla-services/syncstorage-rs/blob/master/syncstorage/src/tokenserver/settings.rs>
for available options.
'';
};
};
};
config = lib.mkIf cfg.enable {
services.mysql = lib.mkIf cfg.database.createLocally {
enable = true;
ensureDatabases = [ cfg.database.name ];
ensureUsers = [{
name = cfg.database.user;
ensurePermissions = {
"${cfg.database.name}.*" = "all privileges";
};
}];
};
systemd.services.firefox-syncserver = {
wantedBy = [ "multi-user.target" ];
requires = lib.mkIf dbIsLocal [ "mysql.service" ];
after = lib.mkIf dbIsLocal [ "mysql.service" ];
restartTriggers = lib.optional cfg.singleNode.enable setupScript;
environment.RUST_LOG = cfg.logLevel;
serviceConfig = {
User = defaultUser;
Group = defaultUser;
ExecStart = "${cfg.package}/bin/syncserver --config ${configFile}";
Stderr = "journal";
EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}";
# hardening
RemoveIPC = true;
CapabilityBoundingSet = [ "" ];
DynamicUser = true;
NoNewPrivileges = true;
PrivateDevices = true;
ProtectClock = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
ProtectKernelModules = true;
SystemCallArchitectures = "native";
# syncstorage-rs uses python-cffi internally, and python-cffi does not
# work with MemoryDenyWriteExecute=true
MemoryDenyWriteExecute = false;
RestrictNamespaces = true;
RestrictSUIDSGID = true;
ProtectHostname = true;
LockPersonality = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictRealtime = true;
ProtectSystem = "strict";
ProtectProc = "invisible";
ProcSubset = "pid";
ProtectHome = true;
PrivateUsers = true;
PrivateTmp = true;
SystemCallFilter = [ "@system-service" "~ @privileged @resources" ];
UMask = "0077";
};
};
systemd.services.firefox-syncserver-setup = lib.mkIf cfg.singleNode.enable {
wantedBy = [ "firefox-syncserver.service" ];
requires = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
after = [ "firefox-syncserver.service" ] ++ lib.optional dbIsLocal "mysql.service";
path = [ config.services.mysql.package ];
serviceConfig.ExecStart = [ "${setupScript}" ];
};
services.nginx.virtualHosts = lib.mkIf cfg.singleNode.enableNginx {
${cfg.singleNode.hostname} = {
enableACME = cfg.singleNode.enableTLS;
forceSSL = cfg.singleNode.enableTLS;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
};
};
};
};
meta = {
maintainers = with lib.maintainers; [ pennae ];
# Don't edit the docbook xml directly, edit the md and generate it:
# `pandoc firefox-syncserver.md -t docbook --top-level-division=chapter --extract-media=media -f markdown+smart > firefox-syncserver.xml`
doc = ./firefox-syncserver.xml;
};
}
|