Teleport SSH/PKI Cluster Module: Init #93836

Church- · 2020-07-25T18:06:14Z

Motivation for this change

Just a basic module for the clustered ssh daemon teleport since none existed.
Planning on a more nuanced module with a config section for each service that teleport offers/works with.

Things done

I assume there's a doc that I'm missing, but where would I look to ensure documentation for the module is added to nixos.org?

More to follow.

correctly brace wise.

aanderse

I have left a few questions and comments.

nixos/modules/services/networking/teleport.nix

aanderse · 2020-07-26T21:14:40Z

nixos/modules/services/networking/teleport.nix

+          Directory to store Teleport Service data.
+        '';
+      };
+      configText = mkOption {


Having a single settings option to represent this file might be worth looking into and match upstream more closely. What were aiming for by splitting this file into multiple? I'm not familiar with this program so don't know the pros and cons of doing so.

I'm not certain what lines you're referring to here? Where am I splitting the file into multiple?

I was mentioning the note you made above:

# This becomes the main config file # To be used in the future when I add seperate option sections for each part of teleport # Rather then writing a single yaml file directly into your nix file.

Since the file format is yaml this maps nicely to a nix attribute set. Very shortly nix will have even nicer support for this, see #75584 if interested.

Ah my apologies, to be clear what I actually meant, was what you implied. Having sub services as attr sets that can be written to the yaml config file.

Rather then just encoding a flat yaml file directly in your nix expression when you enable this service.

Have some scaffolding in place now, and planning to commit the meat of it tomorrow afternoon once I'm off work.
Seems to be working so far from what I have.

This should now make more sense, with the changes I've made to define the service config file in nix expr lang.

nixos/modules/services/networking/teleport.nix

nix expression lang.

Church- · 2020-07-28T04:01:33Z

Revamped the teleport module so that one can now describe your config file in nix expr lang.

Still need descriptions and default values for each option however.

Also missing some options still I'm realizing.
Will add those tomorrow.

Church- · 2020-07-28T16:28:32Z

Hmm, failing. I'll add the defaults next. I assume that might be throwing it off. Since it works on my setup.

aanderse · 2020-08-02T00:07:59Z

@Church- sorry for the delay. I've been meaning to put something together for you. How about something like this?

Just needs examples and descriptions.

Church- · 2020-08-02T03:15:54Z

@aanderse Interesting, just pushed the changes I had for my module.
Everything set via module now.

Just needs examples and descriptions.

Your fork is interesting, I'll admit. Will have to look over it and mull some more.

Church- · 2020-08-02T03:23:07Z

Looking over some more I do admit I do like the idea of having a user just set the attr set by them selves completely.

The only upper hand that my version has is:

self-documenting via examples/description for each option
has easy defaults baked in so someone could just deploy with just a

teleport = {
  enable = true;
  nodename = "foo";
  ... and so on ...
};

And have the ssh service already enabled by default.

Church- · 2020-08-02T03:48:58Z

Aware the change isn't evaling as well, seems I really need those descriptions and examples still. 😛

Church- · 2020-08-08T15:40:40Z

@aanderse Any thoughts?

aanderse · 2020-08-12T01:08:36Z

@Church- the bot is saying "trace: warning: Option `services.teleport.advertise_ip\' has no description.". If you add a description field to every option I think you'll be in better shape.

Church- · 2020-08-12T03:06:00Z

@aanderse

Yep I'm aware! Just wanted your thoughts on the general structure of the module now.

Church- · 2020-08-15T06:26:06Z

@aanderse Yeah as I thought and you confirmed that was the issue.

So, what do you think of the general structure now? Any complaints or worthy to merge down?

to config file.

Church- · 2020-08-16T01:20:44Z

I would actually hold off on reviewing this PR again until I push some new changes.

Somewhat funnily I've decided to end up going with an approach like yours @aanderse after talking with infinisil about his settings PR.

stale · 2021-02-12T05:35:52Z

I marked this as stale due to inactivity. → More info

ymatsiuk · 2021-06-21T13:30:18Z

nixos/modules/services/networking/teleport.nix

+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.teleport}/bin/teleport start ${cmdlineArgs}";
+        ExecReload = "/run/current-system/sw/bin/kill -HUP $MAINPID";


${pkgs.coreutils}/bin/kill maybe? 😉

ymatsiuk

Thanks for putting the effort into creating this module!

ymatsiuk · 2021-06-21T13:44:09Z

nixos/modules/services/networking/teleport.nix

+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.teleport = {


To join teleport node to the cluster we have to run teleport as root and it's ok to run auth and proxy as less privileged user. AFAICS we run always as root with this implementation, don't we?

ymatsiuk · 2022-01-07T10:29:53Z

I found some time to finish the work started here in #153825

Adding a basic module for the teleport cluster ssh/pki service.

1f5920c

More to follow.

Church- changed the title ~~Adding a basic module for the teleport cluster ssh/pki service.~~ Teleport SSH/PKI Cluster Module: Init Jul 25, 2020

ofborg bot added 6.topic: nixos 8.has: module (update) labels Jul 25, 2020

backtrace-ci-bot added 2 commits July 25, 2020 14:13

Fixed a typo in the dataDir option.

c351653

Fixed a few more typos. options/service attr set wasn't balanced

bb5499c

correctly brace wise.

ofborg bot added 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 labels Jul 25, 2020

aanderse reviewed Jul 26, 2020

View reviewed changes

backtrace-ci-bot added 4 commits July 27, 2020 20:57

Made a few clean ups per review.

79a5aa3

More styling fixes per review.

e9639ac

Fixed a typo when setting ExecStart.

c7ee344

Revamped teleport module. Can now set individual teleport services in

f268706

nix expression lang.

Fully revamped teleport module.

e570f6c

Just needs examples and descriptions.

Added descriptions to all service config options.

f870b9e

Cleaned up module option descriptions a bit, set data_dir to be written

19ba970

to config file.

stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Feb 12, 2021

ymatsiuk reviewed Jun 21, 2021

View reviewed changes

stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 21, 2021

ymatsiuk reviewed Jun 21, 2021

View reviewed changes

ymatsiuk closed this Jan 12, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Teleport SSH/PKI Cluster Module: Init #93836

Teleport SSH/PKI Cluster Module: Init #93836

Church- commented Jul 25, 2020 •

edited

aanderse left a comment

aanderse Jul 26, 2020

Church- Jul 27, 2020

aanderse Jul 27, 2020

Church- Jul 27, 2020 •

edited

Church- Jul 28, 2020

Church- commented Jul 28, 2020 •

edited

Church- commented Jul 28, 2020

aanderse commented Aug 2, 2020

Church- commented Aug 2, 2020

Church- commented Aug 2, 2020

Church- commented Aug 2, 2020 •

edited

Church- commented Aug 8, 2020

aanderse commented Aug 12, 2020

Church- commented Aug 12, 2020

Church- commented Aug 15, 2020

Church- commented Aug 16, 2020

stale bot commented Feb 12, 2021

ymatsiuk Jun 21, 2021

ymatsiuk left a comment

ymatsiuk Jun 21, 2021

ymatsiuk commented Jan 7, 2022

Teleport SSH/PKI Cluster Module: Init #93836

Teleport SSH/PKI Cluster Module: Init #93836

Conversation

Church- commented Jul 25, 2020 • edited

Motivation for this change

Things done

aanderse left a comment

Choose a reason for hiding this comment

aanderse Jul 26, 2020

Choose a reason for hiding this comment

Church- Jul 27, 2020

Choose a reason for hiding this comment

aanderse Jul 27, 2020

Choose a reason for hiding this comment

Church- Jul 27, 2020 • edited

Choose a reason for hiding this comment

Church- Jul 28, 2020

Choose a reason for hiding this comment

Church- commented Jul 28, 2020 • edited

Church- commented Jul 28, 2020

aanderse commented Aug 2, 2020

Church- commented Aug 2, 2020

Church- commented Aug 2, 2020

Church- commented Aug 2, 2020 • edited

Church- commented Aug 8, 2020

aanderse commented Aug 12, 2020

Church- commented Aug 12, 2020

Church- commented Aug 15, 2020

Church- commented Aug 16, 2020

stale bot commented Feb 12, 2021

ymatsiuk Jun 21, 2021

Choose a reason for hiding this comment

ymatsiuk left a comment

Choose a reason for hiding this comment

ymatsiuk Jun 21, 2021

Choose a reason for hiding this comment

ymatsiuk commented Jan 7, 2022

Church- commented Jul 25, 2020 •

edited

Church- Jul 27, 2020 •

edited

Church- commented Jul 28, 2020 •

edited

Church- commented Aug 2, 2020 •

edited