Add a web UI for settings-configured routers
router-webui (Go, standard library only) edits settings.json: host name, WAN (DHCP or PPPoE), LANs with DHCP, and the raw JSON for the rest; keys the forms do not know are kept. It applies and confirms by starting router-apply.service and router-confirm.service, which a switch never restarts, and shows the build log and the rollback countdown. HTTPS with a self-signed certificate, a PBKDF2 password hash, CSRF tokens and an Origin check; reachable from management LANs only (new router.managementPorts). router-apply records the settings it built and router-confirm keeps them as settings.confirmed.json (new rollback.onConfirm hook), so the UI can tell unapplied changes and discard them. checks.apply now also logs in from a LAN client, discards the change left by the rollback, edits the DHCP pool, applies and confirms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -226,7 +226,9 @@ in
|
||||
} } accept # wireguard"
|
||||
}
|
||||
${lib.optionalString (dhcpIfaces != [ ]) "iifname ${set dhcpIfaces} udp dport 67 accept"}
|
||||
${lib.optionalString (mgmtIfaces != [ ]) "iifname ${set mgmtIfaces} tcp dport 22 accept"}
|
||||
${lib.optionalString (mgmtIfaces != [ ]) "iifname ${set mgmtIfaces} tcp dport { ${
|
||||
lib.concatMapStringsSep ", " toString ([ 22 ] ++ config.router.managementPorts)
|
||||
} } accept"}
|
||||
}
|
||||
|
||||
chain forward {
|
||||
|
||||
@@ -481,6 +481,16 @@ in
|
||||
);
|
||||
};
|
||||
|
||||
managementPorts = mkOption {
|
||||
type = types.listOf types.port;
|
||||
default = [ ];
|
||||
example = [ 443 ];
|
||||
description = ''
|
||||
TCP ports on the router, besides SSH, reachable from LANs and tunnels
|
||||
with `allowManagement` (the web UI adds its own).
|
||||
'';
|
||||
};
|
||||
|
||||
dns.domain = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
|
||||
@@ -53,6 +53,7 @@ let
|
||||
current=$(readlink -f /run/current-system)
|
||||
${config.nix.package}/bin/nix-env -p ${profile} --set "$current"
|
||||
"$current/bin/switch-to-configuration" boot
|
||||
${cfg.onConfirm}
|
||||
echo "router: confirmed $current"
|
||||
'';
|
||||
};
|
||||
@@ -64,6 +65,12 @@ in
|
||||
default = true;
|
||||
description = "Install the commit-confirm helpers `router-arm`, `router-confirm` and `router-rollback`.";
|
||||
};
|
||||
onConfirm = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
internal = true;
|
||||
description = "Shell commands `router-confirm` runs once the current system is confirmed.";
|
||||
};
|
||||
timeout = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "5min";
|
||||
|
||||
@@ -26,9 +26,13 @@
|
||||
}:
|
||||
let
|
||||
cfg = config.routerSettings;
|
||||
profile = "/nix/var/nix/profiles/system";
|
||||
settings = lib.importJSON cfg.file;
|
||||
system = settings.system or { };
|
||||
|
||||
pending = "/run/router-pending-settings.json";
|
||||
confirmed = "${cfg.stateDirectory}/settings.confirmed.json";
|
||||
|
||||
apply = pkgs.writeShellApplication {
|
||||
name = "router-apply";
|
||||
runtimeInputs = [
|
||||
@@ -37,18 +41,29 @@ let
|
||||
];
|
||||
text = ''
|
||||
timeout=''${1:-${config.router.rollback.timeout}}
|
||||
# Remember what is being built: confirming records it (the web UI shows
|
||||
# settings that differ from it as not yet applied).
|
||||
building=$(mktemp /run/router-building.XXXXXX)
|
||||
cp ${cfg.directory}/settings.json "$building"
|
||||
echo "router: building ${cfg.directory}"
|
||||
new=$(nix build --no-link --print-out-paths --out-link /run/router-pending \
|
||||
"path:${cfg.directory}#nixosConfigurations.router.config.system.build.toplevel")
|
||||
if [ "$new" = "$(readlink -f /run/current-system)" ]; then
|
||||
echo "router: no changes"
|
||||
if [ "$new" = "$(readlink -f ${profile})" ]; then
|
||||
install -m 0600 "$building" ${confirmed}
|
||||
fi
|
||||
rm -f "$building"
|
||||
exit 0
|
||||
fi
|
||||
mv "$building" ${pending}
|
||||
router-arm "$timeout"
|
||||
echo "router: activating $new"
|
||||
"$new/bin/switch-to-configuration" test
|
||||
'';
|
||||
};
|
||||
|
||||
webui = pkgs.callPackage ../../pkgs/router-webui/package.nix { };
|
||||
in
|
||||
{
|
||||
# Outside `router`: the settings file defines that whole tree.
|
||||
@@ -62,12 +77,34 @@ in
|
||||
default = "/var/lib/router/config";
|
||||
description = "Where the configuration (flake and settings) lives on the device.";
|
||||
};
|
||||
stateDirectory = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/router";
|
||||
description = "Secrets and web UI state (password hash, certificate).";
|
||||
};
|
||||
webui = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Serve the web UI (HTTPS) to LANs and tunnels with `allowManagement`.";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 443;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
router = settings.router // {
|
||||
enable = true;
|
||||
};
|
||||
router = lib.mkMerge [
|
||||
(settings.router // { enable = true; })
|
||||
{
|
||||
rollback.onConfirm = ''
|
||||
if [ -e ${pending} ]; then mv ${pending} ${confirmed}; fi
|
||||
'';
|
||||
}
|
||||
(lib.mkIf cfg.webui.enable { managementPorts = [ cfg.webui.port ]; })
|
||||
];
|
||||
|
||||
networking.hostName = system.hostName or "router";
|
||||
time.timeZone = system.timeZone or "UTC";
|
||||
@@ -79,7 +116,64 @@ in
|
||||
"flakes"
|
||||
];
|
||||
|
||||
environment.systemPackages = [ apply ];
|
||||
environment.systemPackages = [
|
||||
apply
|
||||
webui
|
||||
];
|
||||
|
||||
# The web UI starts these rather than running anything itself, so a switch
|
||||
# that restarts the UI does not cut them short; a switch must not restart
|
||||
# or stop them either (router-apply is what runs the switch).
|
||||
systemd.services.router-apply = {
|
||||
description = "Build and activate the router configuration";
|
||||
restartIfChanged = false;
|
||||
stopIfChanged = false;
|
||||
path = [ "/run/current-system/sw" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = lib.getExe apply;
|
||||
TimeoutStartSec = "1h";
|
||||
};
|
||||
};
|
||||
systemd.services.router-confirm = {
|
||||
description = "Confirm the active router configuration";
|
||||
restartIfChanged = false;
|
||||
stopIfChanged = false;
|
||||
path = [ "/run/current-system/sw" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "/run/current-system/sw/bin/router-confirm";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.router-webui = lib.mkIf cfg.webui.enable {
|
||||
description = "Router web UI";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
path = [ config.systemd.package ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${lib.getExe webui} -listen :${toString cfg.webui.port} -config ${cfg.directory} -state ${cfg.stateDirectory}";
|
||||
Restart = "on-failure";
|
||||
# It edits settings and secrets and talks to systemd; nothing else.
|
||||
ProtectSystem = "strict";
|
||||
ReadWritePaths = [ cfg.stateDirectory ];
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_UNIX"
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_NETLINK"
|
||||
];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Rebuilding on the device must work without internet (the uplink may be
|
||||
# what is being configured). What a changed configuration rebuilds is all
|
||||
|
||||
Reference in New Issue
Block a user