Skip to content

Commit b2fc773

Browse files
gngramgngram
committed
enable policy management through ghaf-givc
- Enable policyAdmin defaults in adminvm - Ensure /etc/policies is persisted/available across sysvms (admin/audio/gui/net) and in adminvm storage config - Manage pac configuration through policy - Add business appvm policyAgent config and persist /etc/policies + /etc/proxy with appuser perms - Refactor PAC service options: nest fetcher settings under pacFileFetcher and gate tmpfiles/service behind enable Signed-off-by: Ganga Ram <Ganga.Ram@tii.ae>
1 parent 84cf79a commit b2fc773

File tree

10 files changed

+108
-38
lines changed

10 files changed

+108
-38
lines changed

‎flake.lock‎

Lines changed: 6 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎flake.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@
106106

107107
# Ghaf Inter VM communication and control library
108108
givc = {
109-
url = "github:tiiuae/ghaf-givc";
109+
url = "github:gngram/ghaf-givc/policy-management-meta";
110110
inputs = {
111111
nixpkgs.follows = "nixpkgs";
112112
flake-parts.follows = "flake-parts";

‎modules/givc/adminvm.nix‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# SPDX-FileCopyrightText: 2022-2026 TII (SSRC) and the Ghaf contributors
22
# SPDX-License-Identifier: Apache-2.0
3-
{ config, lib, ... }:
3+
{ config, lib, pkgs, ... }:
44
let
55
cfg = config.ghaf.givc.adminvm;
66
inherit (lib) mkEnableOption mkIf;
@@ -23,6 +23,15 @@ in
2323
inherit (config.ghaf.givc.adminConfig) addresses;
2424
services = map (host: "givc-${host}.service") systemHosts;
2525
tls.enable = config.ghaf.givc.enableTls;
26+
policyAdmin = {
27+
enable = true;
28+
url = "https://github.com/gngram/policy-store.git";
29+
rev = "77f54de54ef8640abb079bf60e5468d9694d850d";
30+
sha256 = "sha256-uStBhfEPwKXClqEeILzECqLrpCG/M/OG+RejZ5U+yvQ=";
31+
opa.enable = true;
32+
monitor.enable = true;
33+
monitor.ref = "deploy";
34+
};
2635
};
2736
ghaf.security.audit.extraRules = [
2837
"-w /etc/givc/ -p wa -k givc-${name}"

‎modules/microvm/appvm.nix‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -91,18 +91,19 @@ let
9191
storagevm = {
9292
enable = true;
9393
name = vmName;
94-
directories =
95-
lib.optionals (!lib.hasAttr "${config.ghaf.users.appUser.name}" config.ghaf.storagevm.users)
94+
directories = lib.optionals
95+
(!lib.hasAttr config.ghaf.users.appUser.name config.ghaf.storagevm.users)
9696
[
97-
# By default, persist appusers entire home directory unless overwritten by defining
97+
# By default, persist appuser's entire home directory unless overwritten by defining
9898
# either storagevm.users.<user>.directories and/or .files explicitly in an appvm.
9999
{
100100
directory = "/home/${config.ghaf.users.appUser.name}";
101-
user = "${config.ghaf.users.appUser.name}";
102-
group = "${config.ghaf.users.appUser.name}";
101+
user = config.ghaf.users.appUser.name;
102+
group = config.ghaf.users.appUser.name;
103103
mode = "0700";
104104
}
105105
];
106+
106107
shared-folders.enable = sharedVmDirectory.enable && builtins.elem vmName sharedVmDirectory.vms;
107108
encryption.enable = configHost.ghaf.virtualization.storagevm-encryption.enable;
108109
};

‎modules/microvm/sysvms/adminvm.nix‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,16 @@ let
5858
"/etc/locale-givc.conf"
5959
"/etc/timezone.conf"
6060
];
61-
directories = lib.mkIf configHost.ghaf.virtualization.storagevm-encryption.enable [
61+
directories = [
62+
{
63+
directory = "/etc/policies";
64+
mode = "0755";
65+
}
66+
]
67+
++ lib.optionals configHost.ghaf.virtualization.storagevm-encryption.enable [
6268
"/var/lib/swtpm"
6369
];
70+
6471
encryption.enable = configHost.ghaf.virtualization.storagevm-encryption.enable;
6572
};
6673
# Networking

‎modules/microvm/sysvms/audiovm.nix‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,12 @@ let
6060
enable = true;
6161
name = vmName;
6262
encryption.enable = configHost.ghaf.virtualization.storagevm-encryption.enable;
63+
directories = [
64+
{
65+
directory = "/etc/policies";
66+
mode = "0755";
67+
}
68+
];
6369
};
6470
# Networking
6571
virtualization.microvm.vm-networking = {

‎modules/microvm/sysvms/guivm.nix‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,12 @@ let
9898
isGuiVm = true;
9999
};
100100
encryption.enable = configHost.ghaf.virtualization.storagevm-encryption.enable;
101+
directories = [
102+
{
103+
directory = "/etc/policies";
104+
mode = "0755";
105+
}
106+
];
101107
};
102108

103109
# Networking

‎modules/microvm/sysvms/netvm.nix‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@ let
6464
enable = true;
6565
name = vmName;
6666
encryption.enable = configHost.ghaf.virtualization.storagevm-encryption.enable;
67+
directories = [
68+
{
69+
directory = "/etc/policies";
70+
mode = "0755";
71+
}
72+
];
6773
};
6874

6975
# Networking

‎modules/reference/appvms/business.nix‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -260,12 +260,41 @@ in
260260
"! -o tun0 -p udp -m multiport --dports 80,443 -j nixos-fw-log-refuse"
261261
];
262262
};
263+
264+
givc.appvm.policyAgent = {
265+
enable = true;
266+
policyConfig = {
267+
"ghaf.pac" = {
268+
action = "${pkgs.rsync}/bin/rsync -a {target} /etc/proxy/";
269+
};
270+
};
271+
};
272+
273+
ghaf.storagevm = {
274+
directories = [
275+
{
276+
directory = "/etc/policies";
277+
user = config.ghaf.users.appUser.name;
278+
group = config.ghaf.users.appUser.name;
279+
mode = "0774";
280+
}
281+
{
282+
directory = "/etc/proxy";
283+
user = config.ghaf.users.appUser.name;
284+
group = config.ghaf.users.appUser.name;
285+
mode = "0774";
286+
}
287+
];
288+
};
263289
# Enable Proxy Auto-Configuration service for the browser
264290
ghaf.reference.services = {
265291
pac = {
266292
enable = true;
267-
proxyAddress = config.ghaf.reference.services.proxy-server.internalAddress;
268-
proxyPort = config.ghaf.reference.services.proxy-server.bindPort;
293+
pacFileFetcher = {
294+
enable = false;
295+
proxyAddress = config.ghaf.reference.services.proxy-server.internalAddress;
296+
proxyPort = config.ghaf.reference.services.proxy-server.bindPort;
297+
};
269298
};
270299

271300
# Enable WireGuard GUI

‎modules/reference/services/pac/pac.nix‎

Lines changed: 28 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ let
1414
pacServerAddr = "127.0.0.1:8000";
1515
_ghafPacFileFetcher =
1616
let
17-
pacFileDownloadUrl = cfg.pacUrl;
18-
proxyServerUrl = "http://${cfg.proxyAddress}:${toString cfg.proxyPort}";
17+
pacFileDownloadUrl = cfg.pacFileFetcher.pacUrl;
18+
proxyServerUrl = "http://${cfg.pacFileFetcher.proxyAddress}:${toString cfg.pacFileFetcher.proxyPort}";
1919
logTag = "ghaf-pac-fetcher";
2020
in
2121
pkgs.writeShellApplication {
@@ -72,29 +72,32 @@ in
7272
{
7373
options.ghaf.reference.services.pac = {
7474
enable = lib.mkEnableOption "Proxy Auto-Configuration (PAC)";
75-
76-
proxyAddress = lib.mkOption {
77-
type = lib.types.str;
78-
description = "Proxy address";
79-
};
80-
81-
proxyPort = lib.mkOption {
82-
type = lib.types.int;
83-
description = "Proxy port";
84-
};
85-
86-
pacUrl = lib.mkOption {
87-
type = lib.types.str;
88-
description = "URL of the Proxy Auto-Configuration (PAC) file";
89-
default = "https://raw.githubusercontent.com/tiiuae/ghaf-rt-config/refs/heads/main/network/proxy/ghaf.pac";
90-
};
91-
9275
proxyPacUrl = lib.mkOption {
9376
type = lib.types.str;
9477
description = "Local PAC URL that can be passed to the browser";
9578
default = "http://${pacServerAddr}/${pacFileName}";
9679
readOnly = true;
9780
};
81+
82+
pacFileFetcher = {
83+
enable = lib.mkEnableOption "PAC file fetcher";
84+
85+
proxyAddress = lib.mkOption {
86+
type = lib.types.str;
87+
description = "Proxy address";
88+
};
89+
90+
proxyPort = lib.mkOption {
91+
type = lib.types.int;
92+
description = "Proxy port";
93+
};
94+
95+
pacUrl = lib.mkOption {
96+
type = lib.types.str;
97+
description = "URL of the Proxy Auto-Configuration (PAC) file";
98+
default = "https://raw.githubusercontent.com/tiiuae/ghaf-rt-config/refs/heads/main/network/proxy/ghaf.pac";
99+
};
100+
};
98101
};
99102

100103
config = lib.mkIf cfg.enable {
@@ -109,9 +112,11 @@ in
109112
};
110113

111114
systemd = {
112-
tmpfiles.rules = [
113-
"f /etc/proxy/${pacFileName} 0664 ${proxyUserName} ${proxyGroupName} - -"
114-
];
115+
tmpfiles = lib.mkIf cfg.pacFileFetcher.enable {
116+
rules = [
117+
"f /etc/proxy/${pacFileName} 0664 ${proxyUserName} ${proxyGroupName} - -"
118+
];
119+
};
115120

116121
services = {
117122
pacServer = {
@@ -131,7 +136,7 @@ in
131136
};
132137
};
133138

134-
ghafPacFileFetcher = {
139+
ghafPacFileFetcher = lib.mkIf cfg.pacFileFetcher.enable {
135140
description = "Fetch ghaf pac file periodically with retries if internet is available";
136141
serviceConfig = {
137142
ExecStart = "${_ghafPacFileFetcher}/bin/ghafPacFileFetcher";

0 commit comments

Comments
 (0)