mcaptcha package and module with nixos tests

This completes #17 Co-authored-by: Shahar "Dawn" Or <[email protected]> Co-authored-by: Rohit <[email protected]> Co-authored-by: Matúš Ferech <[email protected]> Co-authored-by: Alejandro Sanchez Medina <[email protected]>
ngi-nix · Sep 29, 2023 · 011c08e · 011c08e
1 parent da86490
commit 011c08e
Show file tree

Hide file tree

Showing 14 changed files with 5,814 additions and 0 deletions.
diff --git a/all-packages.nix b/all-packages.nix
@@ -21,6 +21,8 @@
 
     libgnunetchat = callPackage ./pkgs/libgnunetchat {};
     librecast = callPackage ./pkgs/librecast {inherit lcrq;};
+    mcaptcha = callPackage ./pkgs/mcaptcha {};
+    mcaptcha-cache = callPackage ./pkgs/mcaptcha-cache {};
     pretalx = callPackage ./pkgs/pretalx {};
     pretalx-frontend = callPackage ./pkgs/pretalx/frontend.nix {};
     pretalx-full = callPackage ./pkgs/pretalx {

diff --git a/modules/all-modules.nix b/modules/all-modules.nix
@@ -3,6 +3,7 @@
   # Refer to <https://github.com/ngi-nix/ngipkgs/issues/40>.
   #liberaforms = import ./liberaforms.nix;
   flarum = import ./flarum.nix;
+  mcaptcha = import ./mcaptcha.nix;
   pretalx = import ./pretalx.nix;
   rosenpass = import ./rosenpass.nix;
   unbootable = import ./unbootable.nix;

diff --git a/modules/mcaptcha.nix b/modules/mcaptcha.nix
@@ -0,0 +1,279 @@
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  ...
+}:
+with builtins;
+with lib; let
+  cfg = config.services.mcaptcha;
+
+  settingsFormat = pkgs.formats.toml {};
+  filteredSettings = lib.attrsets.filterAttrsRecursive (_path: value: value != null) cfg.settings;
+  configFile = settingsFormat.generate "mcaptcha.config.toml" filteredSettings;
+in {
+  options.services.mcaptcha.enable = mkEnableOption "Enable mCaptcha server.";
+  options.services.mcaptcha.package = mkPackageOption pkgs "mcaptcha" {};
+
+  options.services.mcaptcha.settings = lib.mkOption {
+    type = lib.types.submodule {
+      freeformType = settingsFormat.type;
+
+      options.database.name = mkOption {
+        type = types.str;
+        description = "Applies both when `database.createLocally` is set and not.";
+        default = "mcaptcha";
+      };
+
+      options.database.username = mkOption {
+        type = types.nullOr types.str;
+        description = "Ignored when `database.createLocally`.";
+        example = "mcaptcha";
+        default = null;
+      };
+
+      options.database.hostname = mkOption {
+        type = types.nullOr types.str;
+        description = "Ignored when `database.createLocally`.";
+        example = "localhost";
+        default = null;
+      };
+
+      options.database.port = mkOption {
+        type = types.nullOr types.port;
+        description = "Ignored when `database.createLocally`.";
+        example = 5432;
+        default = null;
+      };
+
+      options.server.port = mkOption {
+        type = types.port;
+        description = "Web server port.";
+        default = 7000;
+      };
+
+      options.server.domain = mkOption {
+        type = types.str;
+        description = "Web server host.";
+        default = "localhost";
+        example = "example.com";
+      };
+
+      options.server.ip = mkOption {
+        type = types.str;
+        description = "Web server addresses to bind to.";
+        default = "127.0.0.1";
+        example = "0.0.0.0";
+      };
+    };
+
+    description = ''
+      Extra settings. Best sources of documentation for settings seem to be
+      https://github.com/mCaptcha/mCaptcha/blob/master/config/default.toml
+      https://github.com/mCaptcha/mCaptcha/blob/master/docs/CONFIGURATION.md
+    '';
+  };
+
+  options.services.mcaptcha.user = mkOption {
+    type = types.str;
+    description = "User account to run under.";
+    default = "mcaptcha";
+  };
+
+  options.services.mcaptcha.group = mkOption {
+    type = types.str;
+    description = "Group for the user mCaptcha runs under.";
+    default = "mcaptcha";
+  };
+
+  options.services.mcaptcha.database.createLocally = mkOption {
+    type = types.bool;
+    description = "Whether to create and use a local database instance";
+    default = false;
+  };
+
+  options.services.mcaptcha.database.passwordFile = mkOption {
+    type = types.nullOr types.path;
+    description = ''
+      Path to a file containing a database password.
+
+      Ignored when `database.createLocally`.
+    '';
+    default = null;
+    example = "/run/secrets/mcaptcha/database";
+  };
+
+  options.services.mcaptcha.server.cookieSecretFile = mkOption {
+    type = types.path;
+    description = "Path to a file containing a cookie secret.";
+    example = "/run/secrets/mcaptcha/cookie-secret";
+  };
+
+  options.services.mcaptcha.captcha.saltFile = mkOption {
+    type = types.path;
+    description = "Path to a file containing a salt.";
+    example = "/run/secrets/mcaptcha/salt";
+  };
+
+  options.services.mcaptcha.redis.createLocally = mkOption {
+    type = types.bool;
+    description = "Whether to create a Redis instance locally.";
+    default = false;
+  };
+
+  options.services.mcaptcha.redis.host = mkOption {
+    type = types.str;
+    description = "Ignored when `redis.createLocally`.";
+    example = "redis.example.com";
+  };
+
+  options.services.mcaptcha.redis.port = mkOption {
+    type = types.port;
+    description = "Applies both when `redis.createLocally` is set and not.";
+    default = 6379;
+  };
+
+  options.services.mcaptcha.redis.user = mkOption {
+    type = types.str;
+    description = "Ignored when `redis.createLocally`.";
+    default = "default";
+    example = "mcaptcha";
+  };
+
+  options.services.mcaptcha.redis.passwordFile = mkOption {
+    type = types.path;
+    description = ''
+      Path to a file containing the Redis server password.
+
+      Ignored when `redis.createLocally`.";
+    '';
+    example = "/run/secrets/mcaptcha/redis-secret";
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (!cfg.database.createLocally) -> (cfg.settings.database.username != null);
+        message = "If database.createLocally is not specified, then settings.database.username must be specified";
+      }
+      {
+        assertion = (!cfg.database.createLocally) -> (cfg.settings.database.port != null);
+        message = "If database.createLocally is not specified, then settings.database.port must be specified";
+      }
+      {
+        assertion = (!cfg.database.createLocally) -> (cfg.settings.database.hostname != null);
+        message = "If database.createLocally is not specified, then settings.database.hostname must be specified";
+      }
+    ];
+    services.mcaptcha.settings = {
+      # mCaptcha has no support for defaults. Every option must be specified.
+      # The module-provided defaults below are based on
+      # https://github.com/mCaptcha/mCaptcha/blob/f337ee0643d88723776e1de4e5588dfdb6c0c574/config/default.toml
+      debug = lib.mkDefault false;
+      source_code = lib.mkDefault "https://github.com/mCaptcha/mCaptcha";
+      commercial = lib.mkDefault false;
+      allow_demo = lib.mkDefault false;
+      allow_registration = lib.mkDefault true;
+
+      server = {
+        proxy_has_tls = lib.mkDefault false;
+      };
+
+      database = {
+        pool = lib.mkDefault 4;
+        database_type = lib.mkDefault "postgres";
+      };
+
+      captcha = {
+        gc = lib.mkDefault 30;
+        runners = lib.mkDefault 4;
+        queue_length = lib.mkDefault 2000;
+        enable_stats = lib.mkDefault true;
+
+        default_difficulty_strategy = {
+          avg_traffic_difficulty = lib.mkDefault 50000;
+          peak_sustainable_traffic_difficulty = lib.mkDefault 3000000;
+          broke_my_site_traffic_difficulty = lib.mkDefault 5000000;
+          duration = lib.mkDefault 30;
+        };
+      };
+
+      redis = {
+        pool = lib.mkDefault 4;
+      };
+    };
+
+    systemd.services.mcaptcha.description = "mCaptcha: a CAPTCHA system that gives attackers a run for their money";
+
+    systemd.services.mcaptcha.script = let
+      serverCookieSecret = "export MCAPTCHA_SERVER_COOKIE_SECRET=$(< ${cfg.server.cookieSecretFile})";
+      captchaSalt = "export MCAPTCHA_CAPTCHA_SALT=$(< ${cfg.captcha.saltFile})";
+      databaseLocalUrl = ''export DATABASE_URL="postgres:///${cfg.settings.database.name}?host=/run/postgresql"'';
+      databasePassword = "export MCAPTCHA_DATABASE_PASSWORD=$(< ${cfg.database.passwordFile})";
+      redisLocalUrl = ''export MCAPTCHA_REDIS_URL="redis://${cfg.redis.host}:${builtins.toString cfg.redis.port}"'';
+      redisRemoteUrl = ''
+        redis_user=$(${pkgs.urlencode}/bin/urlencode -e userinfo ${lib.escapeShellArg cfg.redis.user})
+        redis_pass=$(${pkgs.urlencode}/bin/urlencode -e userinfo < ${cfg.redis.passwordFile})
+        export MCAPTCHA_REDIS_URL="redis://$redis_user:$redis_pass@${cfg.redis.host}:${builtins.toString cfg.redis.port}"
+      '';
+      exec = "exec ${cfg.package}/bin/mcaptcha";
+    in
+      concatStringsSep "\n" [
+        serverCookieSecret
+        captchaSalt
+        (
+          if cfg.database.createLocally
+          then databaseLocalUrl
+          else databasePassword
+        )
+        (
+          if cfg.redis.createLocally
+          then redisLocalUrl
+          else redisRemoteUrl
+        )
+        exec
+      ];
+
+    systemd.services.mcaptcha.environment.MCAPTCHA_CONFIG = builtins.toString configFile;
+    systemd.services.mcaptcha.after = ["syslog.target"] ++ lib.optionals cfg.database.createLocally ["postgresql.service"];
+    systemd.services.mcaptcha.bindsTo = lib.optionals cfg.database.createLocally ["postgresql.service"];
+    systemd.services.mcaptcha.wants = ["network-online.target"];
+    systemd.services.mcaptcha.wantedBy = ["multi-user.target"];
+    # Settings modeled after https://github.com/mCaptcha/mCaptcha/blob/f337ee0643d88723776e1de4e5588dfdb6c0c574/docs/DEPLOYMENT.md#6-systemd-service-configuration
+    systemd.services.mcaptcha.serviceConfig.User = cfg.user;
+    systemd.services.mcaptcha.serviceConfig.Type = "simple";
+    systemd.services.mcaptcha.serviceConfig.Restart = "on-failure";
+    systemd.services.mcaptcha.serviceConfig.RestartSec = 1;
+    systemd.services.mcaptcha.serviceConfig.SuccessExitStatus = "3 4";
+    systemd.services.mcaptcha.serviceConfig.RestartForceExitStatus = "3 4";
+    systemd.services.mcaptcha.serviceConfig.SystemCallArchitectures = "native";
+    systemd.services.mcaptcha.serviceConfig.MemoryDenyWriteExecute = true;
+    systemd.services.mcaptcha.serviceConfig.NoNewPrivileges = true;
+
+    users.users."${cfg.user}" = {
+      isSystemUser = true;
+      group = cfg.group;
+    };
+
+    users.groups."${cfg.group}" = {};
+
+    services.postgresql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      ensureDatabases = [cfg.settings.database.name];
+      ensureUsers = [
+        {
+          name = cfg.user;
+          ensurePermissions = {"DATABASE ${cfg.settings.database.name}" = "ALL PRIVILEGES";};
+        }
+      ];
+    };
+
+    services.redis.servers.mcaptcha = lib.mkIf cfg.redis.createLocally {
+      enable = true;
+      port = cfg.redis.port;
+      extraParams = ["--loadmodule" "${pkgs.mcaptcha-cache}/lib/libcache.so"];
+    };
+    services.mcaptcha.redis.host = lib.mkIf cfg.redis.createLocally "127.0.0.1";
+  };
+}