Commit graph

39 commits

Author SHA1 Message Date
Martin Weinelt 24adc01e2e
nixos/home-assistant: allow netlink sockets and /proc/net inspection
Since v2021.5.0 home-assistant uses the ifaddr library in the zeroconf
component to enumerate network interfaces via netlink. Since discovery
is all over the place lets allow AF_NETLINK unconditionally.

It also relies on pyroute2 now, which additionally tries to access files
in /proc/net, so we relax ProtectProc a bit by default as well.

This leaves us with these options unsecured:

✗ PrivateNetwork=                                             Service has access to the host's network                                                                 0.5
✗ RestrictAddressFamilies=~AF_(INET|INET6)                    Service may allocate Internet sockets                                                                    0.3
✗ DeviceAllow=                                                Service has a device ACL with some special devices                                                       0.1
✗ IPAddressDeny=                                              Service does not define an IP address allow list                                                         0.2
✗ PrivateDevices=                                             Service potentially has access to hardware devices                                                       0.2
✗ PrivateUsers=                                               Service has access to other users                                                                        0.2
✗ SystemCallFilter=~@resources                                System call allow list defined for service, and @resources is included (e.g. ioprio_set is allowed)      0.2
✗ RestrictAddressFamilies=~AF_NETLINK                         Service may allocate netlink sockets                                                                     0.1
✗ RootDirectory=/RootImage=                                   Service runs within the host's root directory                                                            0.1
✗ SupplementaryGroups=                                        Service runs with supplementary groups                                                                   0.1
✗ RestrictAddressFamilies=~AF_UNIX                            Service may allocate local sockets                                                                       0.1
✗ ProcSubset=                                                 Service has full access to non-process /proc files (/proc subset=)                                       0.1

→ Overall exposure level for home-assistant.service: 1.6 OK 🙂
2021-05-06 16:55:53 +02:00
Martin Weinelt f41349d30d
nixos/home-assistant: Restart systemd unit on restart service
Home-assistant through its `--runner` commandline flag supports sending
exit code 100 when the `homeassistant.restart` service is called.

With `RestartForceExitStatus` we can listen for that specific exit code
and restart the whole systemd unit, providing an actual clean restart
with fresh processes. Additional treat exit code 100 as a successful
termination.
2021-05-03 00:21:25 +02:00
Martin Weinelt 7d09d7f571
nixos/home-assistant: harden systemd service
This is what is still exposed, and it should still allow things to work
as usual.

✗ PrivateNetwork=                    Service has access to the host's …      0.5
✗ RestrictAddressFamilies=~AF_(INET… Service may allocate Internet soc…      0.3
✗ DeviceAllow=                       Service has a device ACL with som…      0.1
✗ IPAddressDeny=                     Service does not define an IP add…      0.2
✗ PrivateDevices=                    Service potentially has access to…      0.2
✗ PrivateUsers=                      Service has access to other users       0.2
✗ SystemCallFilter=~@resources       System call allow list defined fo…      0.2
✗ RootDirectory=/RootImage=          Service runs within the host's ro…      0.1
✗ SupplementaryGroups=               Service runs with supplementary g…      0.1
✗ RestrictAddressFamilies=~AF_UNIX   Service may allocate local sockets      0.1

→ Overall exposure level for home-assistant.service: 1.6 OK :-)

This can grow to as much as ~1.9 if you use one of the bluetooth or nmap
trackers or the emulated_hue component, all of which required elevated
permisssions.
2021-05-03 00:21:24 +02:00
Robert Schütz 1d9f619311
nixos/home-assistant: warn about overridePythonAttrs in package option 2021-04-17 02:20:07 +02:00
Martin Weinelt 485034873f Revert "nixos/home-assistant: use overridePythonAttrs"
This reverts commit f9bd8b1b7b.
2021-04-13 22:46:36 +02:00
Martin Weinelt 3cb83409d2
Revert "nixos/home-assistant: use override before overridePythonAttrs" 2021-04-12 00:00:57 +02:00
Robert Schütz 5522a67fa5
Merge pull request #118719 from dotlambda/home-assistant-tests
nixos/home-assistant: use override before overridePythonAttrs
2021-04-08 18:19:34 +02:00
Robert Schütz 5e0defcb25 nixos/home-assistant: use override before overridePythonAttrs 2021-04-08 12:30:59 +02:00
Martin Weinelt dc84583452
home-assistant: Move maintainership to home-assistant team 2021-04-07 02:33:24 +02:00
Robert Schütz d01376d81d home-assistant: remove dotlambda from maintainers
I'm currently not using it.
2021-04-04 22:15:13 +02:00
Robert Schütz f9bd8b1b7b nixos/home-assistant: use overridePythonAttrs 2021-04-03 12:43:10 +02:00
Martin Weinelt 1050f1487b
nixos/home-assistant: disable tests on the package by default
We are running over 6000 tests by now and they take around 5 minutes
on faster machines and tests alot of components that endusers will not
actually be using. It is sufficient if we run them on package upgrades
and in the passthrough test.
2021-03-06 03:02:06 +01:00
Matt Votava 746efadcce home-assistant: add allowlist_external_dirs to systemd unit ReadWritePaths 2020-11-19 04:29:03 -08:00
Jörg Thalheim 26e9a3498b
nixos/home-assistant: make service reloadable
This allows quick reloads using the following trick:

$(nix-build --show-trace --no-out-link \
  -E '(with import <nixpkgs/nixos> {};
       pkgs.writeScript "update-hass-config"
       config.systemd.services.home-assistant.preStart)')
systemctl reload home-assistant
2020-06-20 10:31:27 +01:00
Martin Weinelt da6b277f96
nixos/home-assistant: allow arbitrary yaml functions 2020-06-02 15:51:35 +02:00
Jörg Thalheim ee2ea82a68
nixos/home-assistant: make config deep mergeable
This make it possible to split the home-assistant configuration
across multiple files and nix will merge the option in an intuitive
way.
2020-02-28 15:32:03 +00:00
Cole Mickens 90d297c4cd nixos: home-assistant: can dial out 2020-01-19 00:03:44 -08:00
Jörg Thalheim 283e3e7218
nixos/home-assistant: support for secrets 2020-01-09 10:39:50 +00:00
Peter Hoeg e537a0a11e home-assistant: set capabilities for bluetooth 2019-09-23 21:54:16 +08:00
Robert Schütz d280603bd1 nixos/home-assistant: account for introduction of manifest.json
The `availableComponents` now only contain a single attribute for
every integration.
2019-05-04 12:01:23 +02:00
Robert Schütz 77482629b0 nixos/home-assistant: use preferLocalBuild = true for configuration 2019-03-02 12:37:48 +01:00
Robert Schütz 971187eada nixos/home-assistant: account for "The Great Migration"
See https://developers.home-assistant.io/blog/2019/02/19/the-great-migration.html
and https://github.com/NixOS/nixpkgs/issues/55958#issuecomment-466793526.
2019-03-02 12:37:48 +01:00
Robert Schütz e211f55d87 nixos/home-assistant: use availableComponents of configured package
fixes #55958
2019-02-22 17:33:18 +01:00
Robert Schütz efe98cbdc8 nixos/home-assistant: make config.http.server_port an integer 2019-02-09 15:26:55 +01:00
Robert Schütz f85453f060 nixos/home-assistant: add configWritable option 2019-02-03 13:08:11 +01:00
Robert Schütz f908f6c982 nixos/home-assistant: don't run json2yaml at every start 2019-01-29 08:56:51 +01:00
Robert Schütz 7cc7c5374c nixos/home-assistant: add lovelaceConfig option 2019-01-29 08:56:51 +01:00
Peter Hoeg db1a40a882 home-assistant: use SIGINT instead of SIGTERM to shut down (#49571)
hass will ignore the standard SIGTERM sent by systemd during stop/restart and we
then have to wait for the timeout after which systemd will forcefully kill the
process.

If instead if we send SIGINT, hass will shut down nicely.

There are many issues reported upstream about the inability to shut down/restart
and it is *supposed* to work with SIGTERM but doesn't.
2018-11-01 16:39:37 +01:00
Robert Schütz 55a12c9763
nixos/home-assistant: do not always override extraComponents (#43845)
Fixes #43843.
2018-07-20 19:28:29 +02:00
Florian Klink fff5923686 nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
Robin Gloster 852fa6b86f
home-assistant module: add openFirewall option 2018-05-22 14:29:57 +02:00
Robert Schütz e4a6e320bb home-assistant: simplify definition of configFile 2018-04-24 20:49:16 +02:00
Peter Hoeg b886faa6b6 home-assistant: use remarshal to convert configuration to YAML
HA doesn't mind the configuration being JSON instead of YAML but since YAML is
the official language, use that as it allows users to easily exchange config
data with other parties in the community.
2018-04-23 16:53:13 +08:00
Peter Hoeg 4cd88807d8 home-assistant: make port configurable so we can use it elsewhere
Additionally, some settings based on NixOS configuation is set via defaultConfig
which is then merged with the user provided configration.

For now that just means http port and time zone but others can easily be added.
2018-04-23 16:53:12 +08:00
Peter Hoeg 2859483fe9 nixos home-assistant: a couple of fixes (#36338)
a) set path to /run/wrappers so ping works
b) run via a target so we can easily inject other components (config copier,
appdaemon)
2018-03-18 12:46:36 +01:00
Robert Schütz 59eb19224b nixos/home-assistant: support platform=... scheme for autoExtraComponents
See https://home-assistant.io/components/sensor.luftdaten/ for an example component using that scheme.
2018-02-04 11:09:55 +01:00
adisbladis 7ebb82e04f
home-assistant: Fix incorrect xml closing tag 2018-02-03 16:54:02 +08:00
Robert Schütz 78c2ca326e home-assistant: compute extraComponents from config 2018-02-02 09:48:50 +01:00
Robert Schütz bacbc48cfe home-assistant: add NixOS module 2018-01-31 12:30:31 +01:00