diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index ad290f13821f..7f5da547805c 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -331,6 +331,14 @@
services.tetrd.
+
+
+ uptermd, an
+ open-source solution for sharing terminal sessions instantly
+ over the public internet via secure tunnels. Available at
+ services.uptermd.
+
+
agate,
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 8daa515cee7a..acead4120487 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -101,6 +101,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).
+- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
+
- [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable).
- [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 84309f90132f..35de34aac10c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -937,6 +937,7 @@
./services/networking/unifi.nix
./services/video/unifi-video.nix
./services/video/rtsp-simple-server.nix
+ ./services/networking/uptermd.nix
./services/networking/v2ray.nix
./services/networking/vsftpd.nix
./services/networking/wasabibackend.nix
diff --git a/nixos/modules/services/networking/uptermd.nix b/nixos/modules/services/networking/uptermd.nix
new file mode 100644
index 000000000000..072f561f5c3c
--- /dev/null
+++ b/nixos/modules/services/networking/uptermd.nix
@@ -0,0 +1,106 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.uptermd;
+in
+{
+ options = {
+ services.uptermd = {
+ enable = mkEnableOption "uptermd";
+
+ openFirewall = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to open the firewall for the port in .
+ '';
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 2222;
+ description = ''
+ Port the server will listen on.
+ '';
+ };
+
+ listenAddress = mkOption {
+ type = types.str;
+ default = "[::]";
+ example = "127.0.0.1";
+ description = ''
+ Address the server will listen on.
+ '';
+ };
+
+ hostKey = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ example = "/run/keys/upterm_host_ed25519_key";
+ description = ''
+ Path to SSH host key. If not defined, an ed25519 keypair is generated automatically.
+ '';
+ };
+
+ extraFlags = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ example = [ "--debug" ];
+ description = ''
+ Extra flags passed to the uptermd command.
+ '';
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ networking.firewall = mkIf cfg.openFirewall {
+ allowedTCPPorts = [ cfg.port ];
+ };
+
+ systemd.services.uptermd = {
+ description = "Upterm Daemon";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+
+ path = [ pkgs.openssh ];
+
+ preStart = mkIf (cfg.hostKey == null) ''
+ if ! [ -f ssh_host_ed25519_key ]; then
+ ssh-keygen \
+ -t ed25519 \
+ -f ssh_host_ed25519_key \
+ -N ""
+ fi
+ '';
+
+ serviceConfig = {
+ StateDirectory = "uptermd";
+ WorkingDirectory = "/var/lib/uptermd";
+ ExecStart = "${pkgs.upterm}/bin/uptermd --ssh-addr ${cfg.listenAddress}:${toString cfg.port} --private-key ${if cfg.hostKey == null then "ssh_host_ed25519_key" else cfg.hostKey} ${concatStringsSep " " cfg.extraFlags}";
+
+ # Hardening
+ AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+ CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+ PrivateUsers = cfg.port >= 1024;
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ PrivateDevices = true;
+ ProtectClock = true;
+ ProtectControlGroups = true;
+ ProtectHome = true;
+ ProtectHostname = true;
+ ProtectKernelLogs = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ SystemCallArchitectures = "native";
+ SystemCallFilter = "@system-service";
+ };
+ };
+ };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c00f7829ac67..e86dda9cb3d2 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -575,6 +575,7 @@ in
unifi = handleTest ./unifi.nix {};
unit-php = handleTest ./web-servers/unit-php.nix {};
upnp = handleTest ./upnp.nix {};
+ uptermd = handleTest ./uptermd.nix {};
usbguard = handleTest ./usbguard.nix {};
user-activation-scripts = handleTest ./user-activation-scripts.nix {};
uwsgi = handleTest ./uwsgi.nix {};
diff --git a/nixos/tests/uptermd.nix b/nixos/tests/uptermd.nix
new file mode 100644
index 000000000000..b2ff9a1e0d9c
--- /dev/null
+++ b/nixos/tests/uptermd.nix
@@ -0,0 +1,62 @@
+import ./make-test-python.nix ({ pkgs, ...}:
+
+let
+ client = {pkgs, ...}:{
+ environment.systemPackages = [ pkgs.upterm ];
+ };
+in
+{
+ name = "uptermd";
+ meta = with pkgs.lib.maintainers; {
+ maintainers = [ fleaz ];
+ };
+
+ nodes = {
+ server = {config, ...}: {
+ services.uptermd = {
+ enable = true;
+ openFirewall = true;
+ port = 1337;
+ };
+ };
+ client1 = client;
+ client2 = client;
+ };
+
+
+ testScript = ''
+ start_all()
+
+ server.wait_for_unit("uptermd.service")
+ server.wait_for_unit("network-online.target")
+
+ # Add SSH hostkeys from the server to both clients
+ # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file
+ client1.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+ client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+ client2.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+ client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+
+ client1.wait_for_unit("multi-user.target")
+ client1.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+ client1.wait_until_tty_matches(1, "login: ")
+ client1.send_chars("root\n")
+ client1.wait_until_succeeds("pgrep -u root bash")
+
+ client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+ client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n")
+ client1.wait_for_file("/tmp/session-details")
+ client1.send_key("q")
+
+ # uptermd can't connect if we don't have a keypair
+ client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+
+ # Grep the ssh connect command from the output of 'upterm host'
+ ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip()
+
+ # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
+ output = client2.succeed(ssh_command)
+
+ assert output.strip() == "client1"
+ '';
+})
diff --git a/pkgs/tools/misc/upterm/default.nix b/pkgs/tools/misc/upterm/default.nix
index c392dd280272..fe4ac3599a76 100644
--- a/pkgs/tools/misc/upterm/default.nix
+++ b/pkgs/tools/misc/upterm/default.nix
@@ -2,6 +2,7 @@
, buildGo118Module
, fetchFromGitHub
, installShellFiles
+, nixosTests
}:
buildGo118Module rec {
@@ -29,6 +30,8 @@ buildGo118Module rec {
doCheck = true;
+ passthru.tests = { inherit (nixosTests) uptermd; };
+
__darwinAllowLocalNetworking = true;
meta = with lib; {