naturallaw777
ac6c498615
The public IP was previously detected independently in three places,
each contacting a different third party: the Hub (HTTPS echo via
api.ipify.org / ifconfig.me / icanhazip.com on every API call and
background tick), DDNS (myip.opendns.com via OpenDNS), and LiveKit
(embedded STUN). Consolidate into a single detector with one shared
cache so every consumer reads the same value with minimal exposure.
- add modules/core/public-ip.nix: installs /var/lib/sovran/public-ip.py
(pure Python stdlib, no new deps) writing /var/lib/secrets/external-ip
- detection chain (first success wins): explicit pin, fresh cache
(default TTL 300s), STUN binding request over UDP (one packet, no
metadata), DNS myip.opendns.com query, then OPT-IN HTTPS echo
(publicIP.httpsEcho, empty by default — never contacted unless listed)
- privacy: while the cache is fresh zero third parties are contacted;
at most one party learns the IP per refresh interval, via the least
exposing mechanism available
- hub (server.py): _get_external_ip() now reads the shared detector /
cache instead of calling ipify/ifconfig/icanhazip directly
- ddns (njalla.nix): use the shared detector instead of a separate
OpenDNS dig; allow the hardened service to write /var/lib/secrets
- element-calling: livekit-turn-setup falls back to the shared
detector on cold boot; add LiveKit webhooks to lk-jwt-service
(sfu_webhook) so abrupt disconnects are cleaned up immediately;
set LIVEKIT_SANITY_CHECK_INTERVAL_SECONDS=60 as a missed-webhook
guard; drop the dead services.livekit.settings block and set
openFirewall=false (Caddy fronts the SFU; no public 7880/tcp)
- new options: sovran_systemsOS.publicIP.{stunServer,stunPort,
dnsResolver,httpsEcho,cacheTTL}
43 lines
1.2 KiB
Nix
Executable File
43 lines
1.2 KiB
Nix
Executable File
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
imports = [
|
|
# ── Core (always loaded) ──────────────────────────────────
|
|
./core/roles.nix
|
|
./core/role-logic.nix
|
|
./core/caddy.nix
|
|
./core/njalla.nix
|
|
./core/ssh-bootstrap.nix
|
|
./core/tech-support.nix
|
|
./core/sovran_systemsos-desktop.nix
|
|
./core/sshd-localhost.nix
|
|
./core/sovran-hub.nix
|
|
./core/legacy-cleanup.nix
|
|
./core/remote-deploy.nix
|
|
./core/no-sleep.nix
|
|
./core/cpu-performance.nix
|
|
./core/local-domain-loopback.nix
|
|
./core/public-ip.nix
|
|
|
|
# ── Always on (no flag) ───────────────────────────────────
|
|
./php.nix
|
|
./credentials.nix
|
|
|
|
# ── Services (default ON — disable in custom.nix) ─────────
|
|
./synapse.nix
|
|
./wordpress.nix
|
|
./nextcloud.nix
|
|
./vaultwarden.nix
|
|
./bitcoinecosystem.nix
|
|
./wallet-autoconnect.nix
|
|
|
|
# ── Features (default OFF — enable in custom.nix) ─────────
|
|
./haven.nix
|
|
./nwc-wallets.nix
|
|
./element-calling.nix
|
|
./mempool.nix
|
|
./rdp.nix
|
|
./sshd.nix
|
|
];
|
|
}
|