From 6518db291f0d7f24a4556b56438cff93a522a242 Mon Sep 17 00:00:00 2001
From: Noah Masur <7386960+nmasur@users.noreply.github.com>
Date: Sat, 29 Apr 2023 16:00:31 +0000
Subject: [PATCH] enable cloudflare tunnel for ssh

---
 hosts/swan/default.nix                       |  1 +
 modules/nixos/services/cloudflare-tunnel.nix | 67 ++++++++++++++++++++
 modules/nixos/services/default.nix           |  1 +
 private/cloudflared.age                      | 15 +++++
 4 files changed, 84 insertions(+)
 create mode 100644 modules/nixos/services/cloudflare-tunnel.nix
 create mode 100644 private/cloudflared.age

diff --git a/hosts/swan/default.nix b/hosts/swan/default.nix
index 72fa0dd..58e2997 100644
--- a/hosts/swan/default.nix
+++ b/hosts/swan/default.nix
@@ -40,6 +40,7 @@ nixpkgs.lib.nixosSystem {
       neovim.enable = true;
       caddy.enable = true;
       cloudflare.enable = true;
+      cloudflareTunnel.enable = true;
       streamServer = "stream.masu.rs";
       nextcloudServer = "cloud.masu.rs";
       bookServer = "books.masu.rs";
diff --git a/modules/nixos/services/cloudflare-tunnel.nix b/modules/nixos/services/cloudflare-tunnel.nix
new file mode 100644
index 0000000..35aed87
--- /dev/null
+++ b/modules/nixos/services/cloudflare-tunnel.nix
@@ -0,0 +1,67 @@
+{ config, lib, ... }:
+
+# First time setup:
+
+# nix-shell -p cloudflared
+# cloudflared tunnel login
+# cloudflared tunnel create <mytunnel>
+# nix run github:nmasur/dotfiles#encrypt-secret > private/cloudflared.age
+# Paste ~/.cloudflared/<id>.json
+# Set tunnelId = "<id>"
+# Remove ~/.cloudflared/
+
+let tunnelId = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
+
+in {
+
+  options.cloudflareTunnel.enable = lib.mkEnableOption "Use Cloudflare Tunnel";
+
+  config = lib.mkIf config.cloudflare.enable {
+
+    services.cloudflared = {
+      enable = true;
+      tunnels = {
+        "${tunnelId}" = {
+          credentialsFile = config.secrets.cloudflared.dest;
+          default = "http_status:404";
+          ingress = { "*.masu.rs" = "ssh://localhost:22"; };
+        };
+      };
+    };
+
+    environment.etc = {
+      "ssh/ca.pub".text = ''
+        ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org
+      '';
+
+      # Must match the username of the email address in Cloudflare Access
+      "ssh/authorized_principals".text = ''
+        ${config.user}
+      '';
+    };
+
+    services.openssh.extraConfig = ''
+      PubkeyAuthentication yes
+      TrustedUserCAKeys /etc/ssh/ca.pub
+      Match User '${config.user}'
+        AuthorizedPrincipalsFile /etc/ssh/authorized_principals
+        # if there is no existing AuthenticationMethods
+        AuthenticationMethods publickey
+    '';
+
+    # Create credentials file for Cloudflare
+    secrets.cloudflared = {
+      source = ../../../private/cloudflared.age;
+      dest = "${config.secretsDirectory}/cloudflared";
+      owner = "cloudflared";
+      group = "cloudflared";
+      permissions = "0440";
+    };
+    systemd.services.cloudflared-secret = {
+      requiredBy = [ "cloudflared-tunnel-${tunnelId}.service" ];
+      before = [ "cloudflared-tunnel-${tunnelId}.service" ];
+    };
+
+  };
+
+}
diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 9fb0c07..834f260 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -5,6 +5,7 @@
     ./backups.nix
     ./caddy.nix
     ./calibre.nix
+    ./cloudflare-tunnel.nix
     ./cloudflare.nix
     ./gitea.nix
     ./gnupg.nix
diff --git a/private/cloudflared.age b/private/cloudflared.age
new file mode 100644
index 0000000..2d1a00a
--- /dev/null
+++ b/private/cloudflared.age
@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBDL0tZ
+TG9JTEdCMkJ2SnRvaFVLalZIM05JWEc1U0JSK0Q5aEg3TTRscVhRCjhJRGJYL3M5
+T24yRGVQZG1heTJveU1qWCthZ1RJVkRtTksxVGhhR3dIMWcKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIGk2RDZjMEtDblNDcCtvRnFkNnQ1elEzUkdyWWg3M1hNcXBTaEdN
+VGtLM2sKK09Sa3NZNnc3SWlHRXBjcVE0Z3ZHSnY0Zk5pS2UyQ3NSMWh2VzNJeTNm
+NAotPiBzc2gtZWQyNTUxOSBuanZYNUEgWDhkN1B6ajNYcTBGeCtlbHhacnB4Ly9a
+ejJCSVhPcndST0dkN1VZZE1nRQpKeUhCWEk1RkdjajlFMFgzajdmclB3a3FORkp5
+ZTRQK3JXcWE0YUIvL2UwCi0tLSBBYkFQcmwvM0hZbEtBWG1oVUZ5NVhoT2p3U2pF
+VzhGL25La2lJRElDL0o4CtVNQVuouGOOXtVTwdeBd4+CJyglCjFoDoOpXdH35fni
+Azr6JyfKbBlcavrghACWVDem24WIKq7uh9BSL2yHd+sj4umDybuCk9RZWmLgSaHV
+g7Y3jiHa/NTvqd+Wr0PBas4TcOLcICQ0rg9gWnYH+QQDdnv+At4Eqp2/X1ztTI8O
+PRJr7O6HJJasPZSsQldjs3O3fMiLiYPSywCTmgU/gstnv2YhbA3m4vhqOeRskuNg
+X0qAd8jso4Bo7jHohmLLzl1c
+-----END AGE ENCRYPTED FILE-----