1143 simplify api and add pw protection (#1146)

* added way to generate credentials + config for caddy, added caddy as a reverse proxy
* opened up firewall properly again

credentials.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+# Generate 18 random alphanumeric characters base64 encode It
+password=$(head -c 18 /dev/urandom | base64)
+
+echo "Basic Authentication; user=machine password=$password"
+echo $password > /tmp/machine_password
+
+caddy_hash=$(caddy hash-password --plaintext $password)
+
+echo "(machine_basic_auth) {
+    basic_auth {
+        machine $caddy_hash
+    }
+}" | sudo tee /var/lib/caddy/auth_snippet.conf
+
+# Transfer ownership to caddy user
+sudo chown caddy:caddy /var/lib/caddy/auth_snippet.conf
+
+# Tigther permissions (Only readable by root or caddy user)
+sudo chmod 600 /var/lib/caddy/auth_snippet.conf
+
+sudo systemctl restart caddy.service
+

nixos/modules/qitech.nix

@@ -7,6 +7,16 @@ in {
   options.services.qitech = {
     enable = mkEnableOption "QiTech Control";
 
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description =
+        "Whether to open ports in the firewall for the QiTech server";
+    };
+    
+    networking.firewall = mkIf cfg.openFirewall { allowedTCPPorts = [ 443 ]; };
+
     user = mkOption {
       type = types.str;
       default = "qitech-service";

nixos/os/configuration.nix

@@ -64,7 +64,6 @@ in {
 
   ];
 
-  # Add these system settings for a more comprehensive kiosk setup
   boot.kernel.sysctl = {
     "kernel.panic_on_oops" = 1; # Reboot on kernel oops
     "kernel.panic" = 10; # Reboot after 10 seconds on panic
@@ -105,15 +104,7 @@ in {
     }
   ];
 
-  networking.hostName = "nixos"; # Define your hostname.
-  # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
-
-  networking.interfaces.enp1s0.ipv4.addresses = [
-    {
-      address = "10.10.10.1";
-      prefixLength = 24;
-    }
-  ];
+  networking.hostName = "nixos";
 
   # Configure network proxy if necessary
   # networking.proxy.default = "http://user:password@proxy:port/";
@@ -149,9 +140,38 @@ in {
     autoSuspend = false;
     wayland = true;
   };
-
   services.xserver.desktopManager.gnome.enable = true;
 
+  services.caddy = {
+    enable = true;
+    # This puts the import at the TOP of the Caddyfile (Global Scope)
+    extraConfig = ''
+      import /var/lib/caddy/auth_snippet.conf
+    '';
+
+    virtualHosts.":443" = {
+      extraConfig = ''       
+        import machine_basic_auth
+        
+        reverse_proxy localhost:3001
+        
+        tls internal {
+          on_demand
+        }
+
+      '';
+    };
+  };
+  
+  systemd.services.caddy.serviceConfig.ReadOnlyPaths = [ "/var/lib/caddy/auth_snippet.conf" ];
+  #services.caddy = {
+  #  enable = true;
+  #  virtualHosts."localhost".extraConfig = ''
+  #    respond "Hello, world!"
+  #  '';
+  #};
+
+
   # Disable sleep/suspend
   systemd.targets.sleep.enable = false;
   systemd.targets.suspend.enable = false;
@@ -198,12 +218,6 @@ in {
     alsa.enable = true;
     alsa.support32Bit = true;
     pulse.enable = true;
-    # If you want to use JACK applications, uncomment this
-    #jack.enable = true;
-
-    # use the example session manager (no others are packaged yet so this is enabled by default,
-    # no need to redefine it in your config for now)
-    #media-session.enable = true;
   };
 
   # Enable graphics acceleration
@@ -264,6 +278,7 @@ in {
     wireshark
     pciutils
     neofetch
+    caddy
   ];
 
   xdg.portal.enable = true;
@@ -304,51 +319,12 @@ in {
     QITECH_OS_GIT_URL = gitInfo.gitUrl;
   };
 
-  # Set revision labe;
+  # Set revision label
   system.nixos.label = "${gitInfo.gitAbbreviationEscaped}_${gitInfo.gitCommit}";
+  
+  networking.firewall.allowedUDPPorts = [ 53 67 69 ];
+  networking.firewall.allowedTCPPorts = [ 443 ];
 
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
-  # List services that you want to enable:
-
-  # Enable the OpenSSH daemon.
-  # services.openssh.enable = true;
-
-  services.dnsmasq = {
-    enable = true;
-    resolveLocalQueries = false;
-
-    settings = {
-      interface = "enp1s0"; # only this interface
-      bind-interfaces = true;
-      server = [ "1.1.1.1" "8.8.8.8" ];
-
-      # DHCP subnet + pool
-      dhcp-range = "10.10.10.50,10.10.10.250,255.255.255.0,12h";
-
-      # Default gateway (router)
-      dhcp-option = [
-        "3,10.10.10.1"      # option 3 = router
-        "6,1.1.1.1,8.8.8.8" # option 6 = DNS servers
-      ];
-    };
-  };
-
-  networking.firewall.enable = true;
-  networking.firewall.trustedInterfaces = [ "enp1s0" ];
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "24.11"; # Did you read the comment?
 
 }