From 998320c9b17cd4399c109f536b6ae6b658197a42 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Thu, 12 Feb 2015 12:50:17 -0400 Subject: diatom is dead --- config-joey.hs | 12 ------------ 1 file changed, 12 deletions(-) (limited to 'config-joey.hs') diff --git a/config-joey.hs b/config-joey.hs index f87db43e..1bd558ff 100644 --- a/config-joey.hs +++ b/config-joey.hs @@ -43,7 +43,6 @@ hosts = -- (o) ` , clam , orca , kite - , diatom , elephant , beaver ] ++ monsters @@ -223,16 +222,6 @@ kite = standardSystemUnhardened "kite.kitenet.net" Testing "amd64" & branchableSecondary & Dns.secondaryFor ["animx"] hosts "animx.eu.org" -diatom :: Host -diatom = standardSystem "diatom.kitenet.net" (Stable "wheezy") "amd64" - [ "dying" ] - & ipv4 "107.170.31.195" - & Ssh.hostKeys hostContext - [ (SshDsa, "ssh-dss AAAAB3NzaC1kc3MAAACBAO9tnPUT4p+9z7K6/OYuiBNHaij4Nzv5YVBih1vMl+ALz0gYAj8RWJzXmqp5buFAyfgOoLw+H9s1bBS01Sy3i07Dm6cx1fWG4RXL/E/3w1tavX99GD2bBxDBu890ebA5Tp+eFRJkS9+JwSvFiF6CP7NbVjifCagoUO56Ig048RwDAAAAFQDPY2xM3q6KwsVQliel23nrd0rV2QAAAIEAga3hj1hL00rYPNnAUzT8GAaSP62S4W68lusErH+KPbsMwFBFY/Ib1FVf8k6Zn6dZLh/HH/RtJi0JwdzPI1IFW+lwVbKfwBvhQ1lw9cH2rs1UIVgi7Wxdgfy8gEWxf+QIqn62wG+Ulf/HkWGvTrRpoJqlYRNS/gnOWj9Z/4s99koAAACBAM/uJIo2I0nK15wXiTYs/NYUZA7wcErugFn70TRbSgduIFH6U/CQa3rgHJw9DCPCQJLq7pwCnFH7too/qaK+czDk04PsgqV0+Jc7957gU5miPg50d60eJMctHV4eQ1FpwmGGfXxRBR9k2ZvikWYatYir3L6/x1ir7M0bA9IzNU45") - , (SshRsa, "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA2QAJEuvbTmaN9ex9i9bjPhMGj+PHUYq2keIiaIImJ+8mo+yKSaGUxebG4tpuDPx6KZjdycyJt74IXfn1voGUrfzwaEY9NkqOP3v6OWTC3QeUGqDCeJ2ipslbEd9Ep9XBp+/ldDQm60D0XsIZdmDeN6MrHSbKF4fXv1bqpUoUILk=") - ] - & alias "ns2.kitenet.net" - elephant :: Host elephant = standardSystem "elephant.kitenet.net" Unstable "amd64" [ "Storage, big data, and backups, omnomnom!" @@ -265,7 +254,6 @@ elephant = standardSystem "elephant.kitenet.net" Unstable "amd64" & alias "znc.kitenet.net" & JoeySites.ircBouncer - -- I'd rather this were on diatom, but it needs unstable. & alias "kgb.kitenet.net" & JoeySites.kgbServer -- cgit v1.3-2-g0d8e From e8b0e7c6ca34365710d1066984bd3d7026621b70 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Fri, 27 Feb 2015 18:55:51 -0400 Subject: propellor spin --- config-joey.hs | 5 +- debian/changelog | 3 +- propellor.cabal | 2 +- src/Propellor/Property/Tor.hs | 110 ++++++++++++++++++++++-------------------- 4 files changed, 65 insertions(+), 55 deletions(-) (limited to 'config-joey.hs') diff --git a/config-joey.hs b/config-joey.hs index 1bd558ff..bd1a4965 100644 --- a/config-joey.hs +++ b/config-joey.hs @@ -84,8 +84,9 @@ clam = standardSystem "clam.kitenet.net" Unstable "amd64" & Ssh.randomHostKeys & Apt.unattendedUpgrades & Network.ipv6to4 - & Tor.named "kite1" Tor.isRelay' - & Postfix.satellite + & Tor.isRelay + & Tor.named "kite1" + & Tor.bandwidthRate "128 kibibytes" & Docker.configured & Docker.garbageCollected `period` Daily diff --git a/debian/changelog b/debian/changelog index b31c7ed2..47e683c9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,9 @@ -propellor (2.1.1) UNRELEASED; urgency=medium +propellor (2.2.0) UNRELEASED; urgency=medium * When running shimmed (eg in a docker container), improve process name visible in ps. * Add shebang to cron.daily etc files. + * Some changes to tor configuration, minor API change. -- Joey Hess Mon, 16 Feb 2015 19:00:48 -0400 diff --git a/propellor.cabal b/propellor.cabal index 41520baa..06154571 100644 --- a/propellor.cabal +++ b/propellor.cabal @@ -1,5 +1,5 @@ Name: propellor -Version: 2.1.0 +Version: 2.2.0 Cabal-Version: >= 1.6 License: BSD3 Maintainer: Joey Hess diff --git a/src/Propellor/Property/Tor.hs b/src/Propellor/Property/Tor.hs index 8176e643..bf03d631 100644 --- a/src/Propellor/Property/Tor.hs +++ b/src/Propellor/Property/Tor.hs @@ -5,6 +5,7 @@ import qualified Propellor.Property.File as File import qualified Propellor.Property.Apt as Apt import qualified Propellor.Property.Service as Service import Utility.FileMode +import Utility.DataUnits import System.Posix.Files import Data.Char @@ -17,60 +18,36 @@ type NodeName = String -- -- Uses port 443 isBridge :: Property NoInfo -isBridge = isBridge' [] - -isBridge' :: [String] -> Property NoInfo -isBridge' extraconfig = server config +isBridge = configured + [ ("BridgeRelay", "1") + , ("Exitpolicy", "reject *:*") + , ("ORPort", "443") + ] `describe` "tor bridge" - where - config = - [ "BridgeRelay 1" - , "Exitpolicy reject *:*" - , "ORPort 443" - ] ++ extraconfig + `requires` server -- | Sets up a tor relay. -- -- Uses port 443 isRelay :: Property NoInfo -isRelay = isRelay' [] - -isRelay' :: [String] -> Property NoInfo -isRelay' extraconfig = server config +isRelay = configured + [ ("BridgeRelay", "0") + , ("Exitpolicy", "reject *:*") + , ("ORPort", "443") + ] `describe` "tor relay" - where - config = - [ "BridgeRelay 0" - , "Exitpolicy reject *:*" - , "ORPort 443" - ] ++ extraconfig - --- | Converts a property like isBridge' or isRelay' to be a named --- node, with a known private key. + `requires` server + +-- | Makes the tor node be named, with a known private key. -- -- This can be moved to a different IP without needing to wait to -- accumulate trust. --- --- The base property can be used to start out and then upgraded to --- a named property later. -named :: NodeName -> ([String] -> Property NoInfo) -> Property HasInfo -named n basep = p `describe` (getDesc p ++ " " ++ n) - where - p = basep ["Nickname " ++ saneNickname n] - `requires` torPrivKey (Context ("tor " ++ n)) - --- | A tor server (bridge, relay, or exit) --- Don't use if you just want to run tor for personal use. -server :: [String] -> Property NoInfo -server extraconfig = setup - `requires` Apt.installed ["tor", "ntp"] - `describe` "tor server" +named :: NodeName -> Property HasInfo +named n = configured [("Nickname", n')] + `describe` ("tor node named " ++ n') + `requires` torPrivKey (Context ("tor " ++ n)) where - setup = mainConfig `File.hasContent` config - `onChange` restarted - config = - [ "SocksPort 0" - ] ++ extraconfig + n' = saneNickname n torPrivKey :: Context -> Property HasInfo torPrivKey context = f `File.hasPrivContent` context @@ -80,15 +57,47 @@ torPrivKey context = f `File.hasPrivContent` context where f = "/var/lib/tor/keys/secret_id_key" +-- | A tor server (bridge, relay, or exit) +-- Don't use if you just want to run tor for personal use. +server :: Property NoInfo +server = configured [("SocksPort", "0")] + `requires` Apt.installed ["tor", "ntp"] + `describe` "tor server" + +-- | Specifies configuration settings. Any lines in the config file +-- that set other values for the specified settings will be removed, +-- while other settings are left as-is. Tor is restarted when +-- configuration is changed. +configured :: [(String, String)] -> Property NoInfo +configured settings = File.fileProperty "tor configured" go mainConfig + `onChange` restarted + where + ks = map fst settings + go ls = map toconfig $ + filter (\(k, _) -> k `notElem` ks) (map fromconfig ls) + ++ settings + toconfig (k, v) = k ++ " " ++ v + fromconfig = separate (== ' ') + +type BwLimit = String + +-- | Limit incoming and outgoing traffic to the specified +-- amount, per second. +-- +-- For example, "30 kibibytes" is the minimum limit for a useful relay. +bandwidthRate :: BwLimit -> Property NoInfo +bandwidthRate s = case readSize dataUnits s of + Just sz -> configured [("BandwidthRate", show sz ++ " bytes")] + Nothing -> property ("unable to parse " ++ s) noChange + hiddenServiceAvailable :: HiddenServiceName -> Int -> Property NoInfo hiddenServiceAvailable hn port = hiddenServiceHostName prop where - prop = mainConfig `File.containsLines` - [ unwords ["HiddenServiceDir", varLib hn] - , unwords ["HiddenServicePort", show port, "127.0.0.1:" ++ show port] + prop = configured + [ ("HiddenServiceDir", varLib hn) + , ("HiddenServicePort", unwords [show port, "127.0.0.1:" ++ show port]) ] `describe` "hidden service available" - `onChange` Service.reloaded "tor" hiddenServiceHostName p = adjustPropertySatisfy p $ \satisfy -> do r <- satisfy h <- liftIO $ readFile (varLib hn "hostname") @@ -96,12 +105,11 @@ hiddenServiceAvailable hn port = hiddenServiceHostName prop return r hiddenService :: HiddenServiceName -> Int -> Property NoInfo -hiddenService hn port = mainConfig `File.containsLines` - [ unwords ["HiddenServiceDir", varLib hn] - , unwords ["HiddenServicePort", show port, "127.0.0.1:" ++ show port] +hiddenService hn port = configured + [ ("HiddenServiceDir", varLib hn) + , ("HiddenServicePort", unwords [show port, "127.0.0.1:" ++ show port]) ] `describe` unwords ["hidden service available:", hn, show port] - `onChange` restarted hiddenServiceData :: IsContext c => HiddenServiceName -> c -> Property HasInfo hiddenServiceData hn context = combineProperties desc -- cgit v1.3-2-g0d8e From d67d59a25a951f236ee9bde74fd29ed773b3dd86 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Fri, 27 Feb 2015 19:14:20 -0400 Subject: propellor spin --- config-joey.hs | 2 +- src/Propellor/Property/Tor.hs | 19 ++++++++++++++----- 2 files changed, 15 insertions(+), 6 deletions(-) (limited to 'config-joey.hs') diff --git a/config-joey.hs b/config-joey.hs index bd1a4965..f9f4eaa7 100644 --- a/config-joey.hs +++ b/config-joey.hs @@ -86,7 +86,7 @@ clam = standardSystem "clam.kitenet.net" Unstable "amd64" & Network.ipv6to4 & Tor.isRelay & Tor.named "kite1" - & Tor.bandwidthRate "128 kibibytes" + & Tor.bandwidthRate (Tor.PerMonth "400 GB") & Docker.configured & Docker.garbageCollected `period` Daily diff --git a/src/Propellor/Property/Tor.hs b/src/Propellor/Property/Tor.hs index 27c9761f..3a0926be 100644 --- a/src/Propellor/Property/Tor.hs +++ b/src/Propellor/Property/Tor.hs @@ -80,15 +80,24 @@ configured settings = File.fileProperty "tor configured" go mainConfig toconfig (k, v) = k ++ " " ++ v fromconfig = separate (== ' ') -type BwLimit = String +data BwLimit + = PerSecond String + | PerDay String + | PerMonth String -- | Limit incoming and outgoing traffic to the specified --- amount, per second. +-- amount each. -- --- For example, "30 kibibytes" is the minimum limit for a useful relay. +-- For example, PerSecond "30 kibibytes" is the minimum limit +-- for a useful relay. bandwidthRate :: BwLimit -> Property NoInfo -bandwidthRate s = case readSize dataUnits s of - Just sz -> configured [("BandwidthRate", show sz ++ " bytes")] +bandwidthRate (PerSecond s) = bandwidthRate' s 1 +bandwidthRate (PerDay s) = bandwidthRate' s (24*60*60) +bandwidthRate (PerMonth s) = bandwidthRate' s (31*24*60*60) + +bandwidthRate' :: String -> Integer -> Property NoInfo +bandwidthRate' s divby = case readSize dataUnits s of + Just sz -> configured [("BandwidthRate", show (sz `div` divby) ++ " bytes")] Nothing -> property ("unable to parse " ++ s) noChange hiddenServiceAvailable :: HiddenServiceName -> Int -> Property NoInfo -- cgit v1.3-2-g0d8e