rustdesk-server: init module

[ppom0]

Description of changes

Create simple rustdesk module.

Works well on my homeserver, even behind a NAT, with proper port forwarding.

Mentionned in #211751

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[ppom0]

ping @sjau : you asked for it ;)
ping @gaelreyrol & @tjni : do you want to be added as maintainer?

[ppom0]

All those force-pushes to rename rustdesk → rustdesk-server everywhere in the module & module name ^^

[ppom0]

The CI says "error: attribute 'rustdesk-server' missing" although rustdesk-server is in unstable channel 🤔

[h7x4]

The CI says "error: attribute 'rustdesk-server' missing" although rustdesk-server is in unstable channel 🤔

error: builder for '/nix/store/mn9kqzh7b0ff21f8y50yij0c8njaniiv-lazy-options.json.drv' failed with exit code 1;
       last 10 log lines:
       >
       >             8|       description = "The directus package to use";
       >             9|       default = pkgs.rustdesk-server;
       >              |                 ^
       >            10|     };
       > Cacheable portion of option doc build failed.
       > Usually this means that an option attribute that ends up in documentation (eg `default` or `description`) depends on the restricted module arguments `config` or `pkgs`.

I believe this is due to the lack of a defaultText for the package option. Things like descriptions, defaults, and other attributes that is used to build the manual should not depend on pkgs, as mentioned in the last error message.

The easiest way to avoid it is to just swap the whole option out for mkPackageOption.

[h7x4]

Here's a few comments

[h7x4]

Just to make sure - have you tried making this work with systemds DynamicUser? It is usually preferable to creating system users, but isn't always viable due to misc. circumstances.

[ppom0]

Well, it looks like only the hbbs process needs to access the database, so maybe it's not an issue if the two processes don't have the same user…

[root@musi:/var/lib/rustdesk]# ls
db_v2.sqlite3  db_v2.sqlite3-shm  db_v2.sqlite3-wal  id_ed25519  id_ed25519.pub

[root@musi:/var/lib/rustdesk]# lsof .
COMMAND     PID     USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
hbbr    1099978 rustdesk  cwd    DIR    8,1     4096 5284441 .
hbbs    1099979 rustdesk  cwd    DIR    8,1     4096 5284441 .
bash    1167872     root  cwd    DIR    8,1     4096 5284441 .
lsof    1168024     root  cwd    DIR    8,1     4096 5284441 .
lsof    1168025     root  cwd    DIR    8,1     4096 5284441 .

[root@musi:/var/lib/rustdesk]# lsof db_v2.sqlite3*
COMMAND     PID     USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
hbbs    1099979 rustdesk  mem-r  REG    8,1    32768 5244174 db_v2.sqlite3-shm
hbbs    1099979 rustdesk    9ur  REG    8,1    24576 5244173 db_v2.sqlite3
hbbs    1099979 rustdesk   10u   REG    8,1        0 5244167 db_v2.sqlite3-wal
hbbs    1099979 rustdesk   11ur  REG    8,1    32768 5244174 db_v2.sqlite3-shm

[root@musi:/var/lib/rustdesk]# lsof id_ed25519*

[root@musi:/var/lib/rustdesk]#

[ppom0]

I don't know. As there are 2 services involved together, I like having them at one system user. And I'm not a big fan of DynamicUser. But if you (or someone else) insist a bit, then ok I'll make and test the change!

[mkg20001]

DynamicUser and system user creation can be combined - in that case only the extra isolation of DynamicUser is applied (and if database socket authentication is used then it's usually required aswell to have a fixed system user instead of just DynamicUser)

also you don't really need to get rid of the security flags you already set

[ppom0]

I'm unfortunately unable to test this right now due to missing hardware. Is someone able to test this patch?

diff --git a/nixos/modules/services/monitoring/rustdesk-server.nix b/nixos/modules/services/monitoring/rustdesk-server.nix
index a4d85be3caec..885fb608af99 100644
--- a/nixos/modules/services/monitoring/rustdesk-server.nix
+++ b/nixos/modules/services/monitoring/rustdesk-server.nix
@@ -35,15 +35,16 @@ in {
         Slice = "system-rustdesk.slice";
         User  = "rustdesk";
         Group = "rustdesk";
+        DynamicUser = "yes";
         Environment = [];
         WorkingDirectory = "/var/lib/rustdesk";
         StateDirectory   = "rustdesk";
         StateDirectoryMode = "0750";
         LockPersonality = true;
-        NoNewPrivileges = true;
+        # NoNewPrivileges = true; # implied by DynamicUser
         PrivateDevices = true;
         PrivateMounts = true;
-        PrivateTmp = true;
+        # PrivateTmp = true; # implied by DynamicUser
         PrivateUsers = true;
         ProtectClock = true;
         ProtectControlGroups = true;
@@ -53,10 +54,10 @@ in {
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        RemoveIPC = true;
+        # ProtectSystem = "strict"; # implied by DynamicUser
+        # RemoveIPC = true; # implied by DynamicUser
         RestrictNamespaces = true;
-        RestrictSUIDSGID = true;
+        # RestrictSUIDSGID = true; # implied by DynamicUser
       };
     };
   in lib.mkIf cfg.enable {

[sjau]

Just tested this and it works.

Data is now in /var/lib/private/rustdesk instead of /var/lib/rustdesk like before.

[sjau]

Just tested this and it works for me.

The rd-server data (database, keys) are stored in /var/lib/rustdesk.

I bind-mount them to /data/rustdesk, so it won't get wiped on my setup upon reboot.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/3206

[sjau]

Why does ofBorg complain about security.pam.enableSSHAgentAuth when it's not even used in this PR?

[ppom0]

Just rebased on master to trigger ofborg again and see if it helps.