Skip to content

Commit da685e3

Browse files
enesoztrkbrianmcgillion
enesoztrk
authored and
brianmcgillion
committed
Fetcher scripts for MS and Ghaf URLs
* A single script to fetch additional MS and Ghaf URLs in net-vm. * Handling of PAC file by the fetcher script in business-vm. Signed-off-by: Enes Öztürk <enes.ozturk@unikie.com>
1 parent 5178a89 commit da685e3

File tree

5 files changed

+373
-233
lines changed

5 files changed

+373
-233
lines changed

‎modules/reference/appvms/business.nix

+139-13
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,14 @@ let
1111
inherit (lib) mkIf optionalString;
1212
#TODO: Move this to a common place
1313
name = "business";
14+
proxyUserName = "proxy-user";
15+
proxyGroupName = "proxy-admin";
1416
tiiVpnAddr = "151.253.154.18";
15-
vpnOnlyAddr = "${tiiVpnAddr},jira.tii.ae,access.tii.ae,confluence.tii.ae,i-service.tii.ae,catalyst.atrc.ae";
17+
pacFileName = "ghaf.pac";
18+
pacServerAddr = "127.0.0.1:8000";
19+
pacFileUrl = "http://${pacServerAddr}/${pacFileName}";
1620
netvmEntry = builtins.filter (x: x.name == "net-vm") config.ghaf.networking.hosts.entries;
1721
netvmAddress = lib.head (builtins.map (x: x.ip) netvmEntry);
18-
adminvmEntry = builtins.filter (x: x.name == "admin-vm") config.ghaf.networking.hosts.entries;
19-
adminvmAddress = lib.head (builtins.map (x: x.ip) adminvmEntry);
2022
# Remove rounded corners from the text editor window
2123
gnomeTextEditor = pkgs.gnome-text-editor.overrideAttrs (oldAttrs: {
2224
postPatch =
@@ -25,6 +27,75 @@ let
2527
echo -e '\nwindow { border-radius: 0px; }' >> src/style.css
2628
'';
2729
});
30+
31+
_ghafPacFileFetcher =
32+
let
33+
pacFileDownloadUrl = "https://raw.githubusercontent.com/tiiuae/ghaf-rt-config/refs/heads/main/network/proxy/ghaf.pac";
34+
proxyServerUrl = "http://${netvmAddress}:${toString config.ghaf.reference.services.proxy-server.bindPort}";
35+
logTag = "ghaf-pac-fetcher";
36+
in
37+
pkgs.writeShellApplication {
38+
name = "ghafPacFileFetcher";
39+
runtimeInputs = [
40+
pkgs.coreutils # Provides 'mv', 'rm', etc.
41+
pkgs.curl # For downloading PAC files
42+
pkgs.inetutils # Provides 'logger'
43+
];
44+
text = ''
45+
# Variables
46+
TEMP_PAC_PATH=$(mktemp)
47+
LOCAL_PAC_PATH="/etc/proxy/${pacFileName}"
48+
49+
# Logging function with timestamp
50+
log() {
51+
logger -t "${logTag}" "$1"
52+
}
53+
54+
log "Starting the pac file fetch process..."
55+
56+
# Fetch the pac file using curl with a proxy
57+
log "Fetching pac file from ${pacFileDownloadUrl} using proxy ${proxyServerUrl}..."
58+
http_status=$(curl --proxy "${proxyServerUrl}" -s -o "$TEMP_PAC_PATH" -w "%{http_code}" "${pacFileDownloadUrl}")
59+
60+
log "HTTP status code: $http_status"
61+
62+
# Check if the fetch was successful
63+
if [[ "$http_status" -ne 200 ]]; then
64+
log "Error: Failed to download pac file from ${pacFileDownloadUrl}. HTTP status code: $http_status"
65+
rm -f "$TEMP_PAC_PATH" # Clean up temporary file
66+
exit 2
67+
fi
68+
69+
# Verify the downloaded file is not empty
70+
if [[ ! -s "$TEMP_PAC_PATH" ]]; then
71+
log "Error: The downloaded pac file is empty."
72+
rm -f "$TEMP_PAC_PATH" # Clean up temporary file
73+
exit 3
74+
fi
75+
76+
# Log the download success
77+
log "Pac file downloaded successfully. Proceeding with update..."
78+
79+
# Copy the content from the temporary pac file to the target file
80+
log "Copying the content from temporary file to the target pac file at $LOCAL_PAC_PATH..."
81+
82+
# Check if the copy was successful
83+
if cat "$TEMP_PAC_PATH" > "$LOCAL_PAC_PATH"; then
84+
log "Pac file successfully updated at $LOCAL_PAC_PATH."
85+
else
86+
log "Error: Failed to update the pac file at $LOCAL_PAC_PATH."
87+
rm -f "$TEMP_PAC_PATH" # Clean up temporary file
88+
exit 4
89+
fi
90+
91+
# Clean up temporary file
92+
rm -f "$TEMP_PAC_PATH"
93+
94+
log "Pac file fetch and update process completed successfully."
95+
exit 0
96+
'';
97+
};
98+
2899
in
29100
{
30101
name = "${name}";
@@ -36,7 +107,7 @@ in
36107
pkgs.openconnect
37108
gnomeTextEditor
38109
pkgs.xarchiver
39-
110+
pkgs.busybox
40111
]
41112
++ lib.optionals config.ghaf.profiles.debug.enable [ pkgs.tcpdump ]
42113
++ lib.optionals config.ghaf.givc.enable [ pkgs.open-normal-extension ];
@@ -71,20 +142,20 @@ in
71142
applications = [
72143
{
73144
name = "google-chrome";
74-
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --enable-features=UseOzonePlatform --ozone-platform=wayland ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
145+
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --proxy-pac-url=${pacFileUrl} --enable-features=UseOzonePlatform --ozone-platform=wayland ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
75146
args = [ "url" ];
76147
}
77148
{
78149
name = "outlook";
79-
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --enable-features=UseOzonePlatform --ozone-platform=wayland --app=https://outlook.office.com/mail/ ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
150+
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --proxy-pac-url=${pacFileUrl} --enable-features=UseOzonePlatform --ozone-platform=wayland --app=https://outlook.office.com/mail/ ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
80151
}
81152
{
82153
name = "office";
83-
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --enable-features=UseOzonePlatform --ozone-platform=wayland --app=https://microsoft365.com ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
154+
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --proxy-pac-url=${pacFileUrl} --enable-features=UseOzonePlatform --ozone-platform=wayland --app=https://microsoft365.com ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
84155
}
85156
{
86157
name = "teams";
87-
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --enable-features=UseOzonePlatform --ozone-platform=wayland --app=https://teams.microsoft.com ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
158+
command = "${config.ghaf.givc.appPrefix}/run-waypipe ${config.ghaf.givc.appPrefix}/google-chrome-stable --proxy-pac-url=${pacFileUrl} --enable-features=UseOzonePlatform --ozone-platform=wayland --app=https://teams.microsoft.com ${config.ghaf.givc.idsExtraArgs} --load-extension=${pkgs.open-normal-extension}";
88159
}
89160
{
90161
name = "gpclient";
@@ -107,7 +178,6 @@ in
107178

108179
reference = {
109180
programs.google-chrome.enable = true;
110-
111181
services.globalprotect = {
112182
enable = true;
113183
csdWrapper = "${pkgs.openconnect}/libexec/openconnect/hipreport.sh";
@@ -149,13 +219,66 @@ in
149219
# Enable dconf and icon pack for gnome text editor
150220
programs.dconf.enable = true;
151221
environment.systemPackages = [ pkgs.adwaita-icon-theme ];
222+
# Define a new group for proxy management
223+
users.groups.${proxyGroupName} = { }; # Create a group named proxy-admin
224+
225+
# Define a new user with a specific username
226+
users.users.${proxyUserName} = {
227+
isSystemUser = true;
228+
description = "Proxy User for managing allowlist and services";
229+
# extraGroups = [ "${proxyGroupName}" ]; # Adding to 'proxy-admin' for specific access
230+
group = "${proxyGroupName}";
231+
};
232+
233+
environment.etc."proxy/${pacFileName}" = {
234+
text = '''';
235+
user = "${proxyUserName}"; # Owner is proxy-user
236+
group = "${proxyGroupName}"; # Group is proxy-admin
237+
mode = "0664"; # Permissions: read/write for owner/group, no permissions for others
238+
};
239+
240+
systemd.services.pacServer = {
241+
description = "Http server to make PAC file accessible for web browsers";
242+
wantedBy = [ "multi-user.target" ];
243+
after = [ "network.target" ];
244+
serviceConfig = {
245+
ExecStart = "${pkgs.busybox}/bin/busybox httpd -f -p ${pacServerAddr} -h /etc/proxy";
246+
# Ensure ghafFetchUrl starts after the network is up
247+
Type = "simple";
248+
# Restart policy on failure
249+
Restart = "always"; # Restart the service if it fails
250+
RestartSec = "15s"; # Wait 15 seconds before restarting
251+
User = "${proxyUserName}";
252+
};
253+
};
254+
255+
systemd.services.ghafPacFileFetcher = {
256+
description = "Fetch ghaf pac file periodically with retries if internet is available";
257+
258+
serviceConfig = {
259+
ExecStart = "${_ghafPacFileFetcher}/bin/ghafPacFileFetcher";
260+
# Ensure ghafFetchUrl starts after the network is up
261+
Type = "simple";
262+
# Restart policy on failure
263+
Restart = "on-failure"; # Restart the service if it fails
264+
RestartSec = "15s"; # Wait 15 seconds before restarting
265+
User = "${proxyUserName}";
266+
};
267+
};
268+
269+
systemd.timers.ghafPacFileFetcher = {
270+
description = "Run ghafPacFileFetcher periodically";
271+
wantedBy = [ "timers.target" ];
272+
timerConfig = {
273+
User = "${proxyUserName}";
274+
Persistent = true; # Ensures the timer runs after a system reboot
275+
OnCalendar = "daily"; # Set to your desired schedule
276+
OnBootSec = "90s";
277+
};
278+
};
152279

153280
#Firewall Settings
154281
networking = {
155-
proxy = {
156-
default = "http://${netvmAddress}:${toString config.ghaf.reference.services.proxy-server.bindPort}";
157-
noProxy = "192.168.101.10,${adminvmAddress},127.0.0.1,localhost,${vpnOnlyAddr}";
158-
};
159282
firewall = {
160283
enable = true;
161284
extraCommands = ''
@@ -170,6 +293,9 @@ in
170293
# Default policy
171294
iptables -P INPUT DROP
172295
296+
iptables -A INPUT -i lo -j ACCEPT
297+
iptables -A OUTPUT -o lo -j ACCEPT
298+
173299
# Block any other unwanted traffic (optional)
174300
iptables -N logreject
175301
iptables -A logreject -j LOG

‎modules/reference/programs/google-chrome.nix

+23-6
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ in
2020
PromptForDownloadLocation = true;
2121
AlwaysOpenPdfExternally = true;
2222
DefaultBrowserSettingEnabled = true;
23-
StartupBrowserWindowLaunchSuppressed = true;
24-
DeviceMetricsReportingEnabled = false;
2523
MetricsReportingEnabled = false;
2624
};
2725
example = lib.literalExpression ''
@@ -30,6 +28,7 @@ in
3028
}
3129
'';
3230
};
31+
3332
extraOpts = lib.mkOption {
3433
type = lib.types.attrs;
3534
description = ''
@@ -38,9 +37,9 @@ in
3837
<https://cloud.google.com/docs/chrome-enterprise/policies/>
3938
Make sure the selected policy is supported on Linux and your browser version.
4039
'';
41-
default = {
42-
43-
};
40+
default =
41+
{
42+
};
4443
example = lib.literalExpression ''
4544
{
4645
"BrowserSignin" = 0;
@@ -54,15 +53,33 @@ in
5453
}
5554
'';
5655
};
56+
57+
policyOwner = lib.mkOption {
58+
type = lib.types.str;
59+
default = "root";
60+
description = "Policy files owner";
61+
};
62+
63+
policyOwnerGroup = lib.mkOption {
64+
type = lib.types.str;
65+
default = "root";
66+
description = "Policy files group";
67+
};
5768
};
5869
config = lib.mkIf cfg.enable {
5970

6071
environment.etc = {
6172
"opt/chrome/policies/managed/default.json" = lib.mkIf (cfg.defaultPolicy != { }) {
6273
text = builtins.toJSON cfg.defaultPolicy;
74+
user = "${cfg.policyOwner}"; # Owner is proxy-user
75+
group = "${cfg.policyOwnerGroup}"; # Group is proxy-admin
76+
mode = "0664"; # Permissions: read/write for owner/group, no permissions for others
6377
};
64-
"opt/chrome/policies/managed/extra.json" = lib.mkIf (cfg.extraOpts != { }) {
78+
"opt/chrome/policies/managed/extra.json" = {
6579
text = builtins.toJSON cfg.extraOpts;
80+
user = "${cfg.policyOwner}"; # Owner is proxy-user
81+
group = "${cfg.policyOwnerGroup}"; # Group is proxy-admin
82+
mode = "0664"; # Permissions: read/write for owner/group, no permissions for others
6683
};
6784

6885
};

0 commit comments

Comments
 (0)