Skip to content

Commit 8906c7c

Browse files
randomizedcoderrandomizedcoder
authored
Merge pull request #17 from randomizedcoder/2025_10_13
2025 10 13
2 parents 087764d + 0554882 commit 8906c7c

File tree

99 files changed

+10826
-2589
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

99 files changed

+10826
-2589
lines changed

‎chromebox/chromebox3/configuration.nix‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,8 @@
8585
description = "das";
8686
password = "admin123";
8787
extraGroups = [ "wheel" "libvirtd" "docker" "kubernetes" ];
88-
packages = with pkgs; [
89-
];
88+
# packages = with pkgs; [
89+
# ];
9090
# https://nixos.wiki/wiki/SSH_public_key_authentication
9191
openssh.authorizedKeys.keys = [
9292
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGMCFUMSCFJX95eLfm7P9r72NBp9I1FiXwNwJ+x/HGPV das@t"

‎desktop/l/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ endif
1818
rebuild:
1919
sudo nixos-rebuild switch --flake .
2020

21-
rebuild_t:
21+
rebuild_l:
2222
sudo nixos-rebuild switch --flake .#t
2323

2424
#https://nixos.org/manual/nixos/unstable/index.html#sec-nix-network-issues

‎desktop/l/clickhouse-service.nix‎

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
#
2+
# ClickHouse service with enhanced security restrictions
3+
#
4+
5+
{ config, lib, pkgs, ... }:
6+
7+
let
8+
clickhouseDataDir = "/var/lib/clickhouse";
9+
clickhouseLogDir = "/var/log/clickhouse";
10+
clickhouseConfigDir = "/etc/clickhouse-server";
11+
clickhouseRunDir = "/run/clickhouse-server";
12+
13+
in {
14+
# Enable ClickHouse service
15+
services.clickhouse.enable = false;
16+
17+
# Override the default ClickHouse service with enhanced security
18+
systemd.services.clickhouse = {
19+
20+
serviceConfig = {
21+
# Resource limits - ClickHouse is memory and CPU intensive
22+
Slice = "clickhouse.slice";
23+
MemoryHigh = "2G";
24+
MemoryMax = "4G";
25+
CPUQuota = "50%";
26+
TasksMax = 50000; # ClickHouse can spawn many threads (increased from 1000). Clickhouse warns if this is below 30k.
27+
LimitNPROC = 50000; # Increased for concurrent operations (increased from 2000)
28+
LimitNOFILE = 1048576; # 65536; # ClickHouse needs many file descriptors
29+
Nice = 0; # -20 is the highest priority, 0 is the default
30+
31+
# Security restrictions - ClickHouse needs minimal privileges
32+
NoNewPrivileges = true;
33+
ProtectSystem = "strict";
34+
ProtectHome = true;
35+
ProtectKernelTunables = true;
36+
ProtectKernelModules = true;
37+
ProtectControlGroups = true;
38+
ProtectKernelLogs = true;
39+
PrivateDevices = true;
40+
PrivateTmp = true;
41+
RestrictRealtime = true;
42+
RestrictSUIDSGID = true;
43+
RestrictNamespaces = true;
44+
PrivateUsers = true; # Create user namespace - service sees itself as root internally
45+
LockPersonality = true;
46+
ProtectHostname = true;
47+
ProtectClock = true;
48+
# MemoryDenyWriteExecute = true; # Disabled for ClickHouse JIT compilation
49+
UMask = "0077"; # More restrictive: only owner can read/write ("0027" is the default, and allows group and other to read/write)
50+
51+
# Network capabilities - ClickHouse needs network access for queries
52+
# CAP_NET_BIND_SERVICE: Required for binding to ports (default 9000, 8123)
53+
# CAP_SYS_NICE: Required for setting process priority
54+
# CAP_SYS_RESOURCE: Required for resource limits and CPU affinity
55+
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_NICE" "CAP_SYS_RESOURCE" ];
56+
57+
# Address families - ClickHouse needs IPv4 and IPv6
58+
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
59+
60+
# System call architecture restrictions
61+
SystemCallArchitectures = [ "native" ];
62+
63+
# System call filtering - ClickHouse needs database-related system calls
64+
# Relaxed to allow CPU affinity and resource management
65+
SystemCallFilter = [
66+
"@system-service"
67+
"~@privileged"
68+
"~@mount"
69+
"~@debug"
70+
"~@module"
71+
"~@reboot"
72+
"~@swap"
73+
"~@cpu-emulation"
74+
"~@obsolete"
75+
"~@raw-io"
76+
"~@resources"
77+
# Allow specific system calls that ClickHouse needs for CPU affinity and scheduling
78+
"sched_setaffinity"
79+
"sched_getaffinity"
80+
"setpriority"
81+
"getpriority"
82+
"sched_setparam"
83+
"sched_getparam"
84+
"sched_setscheduler"
85+
"sched_getscheduler"
86+
"sched_setattr"
87+
"sched_getattr"
88+
# Allow system calls needed for JIT compilation
89+
"mprotect"
90+
"mmap"
91+
"munmap"
92+
];
93+
94+
# File system restrictions
95+
ReadWritePaths = [
96+
clickhouseDataDir
97+
clickhouseLogDir
98+
clickhouseRunDir
99+
"/tmp"
100+
"/var/tmp"
101+
"/proc/self"
102+
];
103+
ReadOnlyPaths = [
104+
"/nix/store"
105+
"${pkgs.clickhouse}"
106+
clickhouseConfigDir
107+
"/etc/resolv.conf"
108+
"/etc/hosts"
109+
"/etc/nsswitch.conf"
110+
"/etc/ssl"
111+
"/etc/ca-bundle.crt"
112+
"/etc/ssl/certs"
113+
"/usr/share/zoneinfo"
114+
"/etc/localtime"
115+
];
116+
117+
# User/group restrictions
118+
User = "clickhouse";
119+
Group = "clickhouse";
120+
121+
# Runtime directory
122+
RuntimeDirectory = "clickhouse-server";
123+
124+
# Restart policy
125+
Restart = "always";
126+
RestartSec = "1s";
127+
128+
# Additional security measures
129+
RemoveIPC = true; # Clean up IPC objects
130+
ProtectProc = "default"; # Allow access to process info and /proc/net
131+
ProcSubset = "pid"; # Only allow access to own process info
132+
133+
# Environment
134+
Environment = [
135+
"PATH=${pkgs.clickhouse}/bin"
136+
"CLICKHOUSE_WATCHDOG_ENABLE=0"
137+
];
138+
PIDFile = "${clickhouseRunDir}/clickhouse-server.pid";
139+
140+
# Device access - ClickHouse doesn't need special device access
141+
DeviceAllow = [
142+
"/dev/null rw"
143+
"/dev/zero rw"
144+
"/dev/random r"
145+
"/dev/urandom r"
146+
];
147+
148+
# # IP address restrictions - Only allow local connections by default
149+
# # Modify this if you need external access
150+
# IPAddressAllow = [
151+
# "localhost"
152+
# "127.0.0.1"
153+
# "::1"
154+
# ];
155+
# IPAddressDeny = [
156+
# "any"
157+
# ];
158+
159+
# Supplementary groups - ClickHouse doesn't need additional groups
160+
SupplementaryGroups = [];
161+
162+
# Keyring mode - ClickHouse doesn't need keyring access
163+
KeyringMode = "private";
164+
165+
# Delegate - ClickHouse doesn't need cgroup delegation
166+
Delegate = false;
167+
168+
# Notify access - Only main process can alter service state
169+
NotifyAccess = "main";
170+
};
171+
};
172+
173+
# Create dedicated slice for ClickHouse with resource limits
174+
systemd.slices.clickhouse = {
175+
description = "ClickHouse database slice";
176+
sliceConfig = {
177+
MemoryHigh = "2G";
178+
MemoryMax = "4G";
179+
CPUQuota = "50%";
180+
TasksMax = 50000; # ClickHouse can spawn many threads (increased from 1000). Clickhouse warns if this is below 30k.
181+
};
182+
};
183+
184+
# Create required directories with correct ownership
185+
systemd.tmpfiles.rules = [
186+
"d ${clickhouseDataDir} 0755 clickhouse clickhouse - -"
187+
"d ${clickhouseLogDir} 0755 clickhouse clickhouse - -"
188+
"d ${clickhouseRunDir} 0755 clickhouse clickhouse - -"
189+
"d ${clickhouseConfigDir} 0755 clickhouse clickhouse - -"
190+
];
191+
192+
# Firewall rules for ClickHouse (only if you need external access)
193+
# By default, ClickHouse only listens on localhost
194+
# Uncomment and modify if you need external access
195+
# networking.firewall.allowedTCPPorts = [ 9000 8123 ];
196+
197+
# # Additional security hardening
198+
# security.apparmor.enable = true;
199+
200+
# Optional: Create AppArmor profile for ClickHouse
201+
# This would require additional configuration in a separate file
202+
# security.apparmor.profiles = {
203+
# "clickhouse" = {
204+
# profile = ''
205+
# #include <tunables/global>
206+
# profile clickhouse flags=(attach_disconnected) {
207+
# #include <abstractions/base>
208+
# #include <abstractions/nameservice>
209+
#
210+
# ${clickhouseDataDir}/** rw,
211+
# ${clickhouseLogDir}/** rw,
212+
# ${clickhouseConfigDir}/** r,
213+
# ${clickhouseRunDir}/** rw,
214+
#
215+
# /nix/store/** r,
216+
# /tmp/** rw,
217+
# /var/tmp/** rw,
218+
#
219+
# /proc/sys/kernel/hostname r,
220+
# /proc/sys/kernel/random/uuid r,
221+
# /proc/net/** r,
222+
# /proc/self/** r,
223+
#
224+
# /dev/null rw,
225+
# /dev/zero r,
226+
# /dev/random r,
227+
# /dev/urandom r,
228+
# }
229+
# '';
230+
# };
231+
# };
232+
}

0 commit comments

Comments
 (0)