JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #56265 from aanderse/permissions-start-only

Browse Source 
replace deprecated usage of PermissionsStartOnly (part 2)
This commit is contained in:
Graham Christensen 2019-06-25 18:04:22 -04:00 committed by GitHub
commit 38c28ef10c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
33 changed files with 142 additions and 183 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
nixos/modules/services/audio/mopidy.nix
View File

@ -70,25 +70,25 @@ in {
config = mkIf cfg.enable {
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - mopidy mopidy - -"
];
systemd.services.mopidy = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" "sound.target" ];
description = "mopidy music player daemon";
preStart = "mkdir -p ${cfg.dataDir} && chown -R mopidy:mopidy ${cfg.dataDir}";
serviceConfig = {
ExecStart = "${mopidyEnv}/bin/mopidy --config ${concatStringsSep ":" ([mopidyConf] ++ cfg.extraConfigFiles)}";
User = "mopidy";
PermissionsStartOnly = true;
};
};
systemd.services.mopidy-scan = {
description = "mopidy local files scanner";
preStart = "mkdir -p ${cfg.dataDir} && chown -R mopidy:mopidy ${cfg.dataDir}";
serviceConfig = {
ExecStart = "${mopidyEnv}/bin/mopidy --config ${concatStringsSep ":" ([mopidyConf] ++ cfg.extraConfigFiles)} local scan";
User = "mopidy";
PermissionsStartOnly = true;
Type = "oneshot";
};
};
@ -98,7 +98,7 @@ in {
group = "mopidy";
extraGroups = [ "audio" ];
description = "Mopidy daemon user";
home = "${cfg.dataDir}";
home = cfg.dataDir;
};
users.groups.mopidy.gid = gid;

6
nixos/modules/services/audio/slimserver.nix
View File

@ -42,15 +42,17 @@ in {
config = mkIf cfg.enable {
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - slimserver slimserver - -"
];
systemd.services.slimserver = {
after = [ "network.target" ];
description = "Slim Server for Logitech Squeezebox Players";
wantedBy = [ "multi-user.target" ];
preStart = "mkdir -p ${cfg.dataDir} && chown -R slimserver:slimserver ${cfg.dataDir}";
serviceConfig = {
User = "slimserver";
PermissionsStartOnly = true;
# Issue 40589: Disable broken image/video support (audio still works!)
ExecStart = "${cfg.package}/slimserver.pl --logdir ${cfg.dataDir}/logs --prefsdir ${cfg.dataDir}/prefs --cachedir ${cfg.dataDir}/cache --noimage --novideo";
};

9
nixos/modules/services/computing/boinc/client.nix
View File

@ -105,19 +105,18 @@ in
isSystemUser = true;
};
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - boinc - - -"
];
systemd.services.boinc = {
description = "BOINC Client";
after = ["network.target" "local-fs.target"];
wantedBy = ["multi-user.target"];
preStart = ''
mkdir -p ${cfg.dataDir}
chown boinc ${cfg.dataDir}
'';
script = ''
${fhsEnvExecutable} --dir ${cfg.dataDir} --redirectio ${allowRemoteGuiRpcFlag}
'';
serviceConfig = {
PermissionsStartOnly = true; # preStart must be run as root
User = "boinc";
Nice = 10;
};

14
nixos/modules/services/databases/firebird.nix
View File

@ -95,6 +95,11 @@ in
environment.systemPackages = [cfg.package];
systemd.tmpfiles.rules = [
"d '${dataDir}' 0700 ${cfg.user} - - -"
"d '${systemDir}' 0700 ${cfg.user} - - -"
];
systemd.services.firebird =
{ description = "Firebird Super-Server";
@ -104,21 +109,16 @@ in
# is a better way
preStart =
''
mkdir -m 0700 -p \
"${dataDir}" \
"${systemDir}" \
/var/log/firebird
if ! test -e "${systemDir}/security2.fdb"; then
cp ${firebird}/security2.fdb "${systemDir}"
fi
chown -R ${cfg.user} "${dataDir}" "${systemDir}" /var/log/firebird
chmod -R 700 "${dataDir}" "${systemDir}" /var/log/firebird
'';
serviceConfig.PermissionsStartOnly = true; # preStart must be run as root
serviceConfig.User = cfg.user;
serviceConfig.LogsDirectory = "firebird";
serviceConfig.LogsDirectoryMode = "0700";
serviceConfig.ExecStart = ''${firebird}/bin/fbserver -d'';
# TODO think about shutdown

22
nixos/modules/services/databases/foundationdb.nix
View File

@ -359,6 +359,13 @@ in
}
];
systemd.tmpfiles.rules = [
"d /etc/foundationdb 0755 ${cfg.user} ${cfg.group} - -"
"d '${cfg.dataDir}' 0770 ${cfg.user} ${cfg.group} - -"
"d '${cfg.logDir}' 0770 ${cfg.user} ${cfg.group} - -"
"F '${cfg.pidFile}' - ${cfg.user} ${cfg.group} - -"
];
systemd.services.foundationdb = {
description = "FoundationDB Service";
@ -396,25 +403,12 @@ in
path = [ pkg pkgs.coreutils ];
preStart = ''
rm -f ${cfg.pidfile} && \
touch ${cfg.pidfile} && \
chown -R ${cfg.user}:${cfg.group} ${cfg.pidfile}
for x in "${cfg.logDir}" "${cfg.dataDir}"; do
[ ! -d "$x" ] && mkdir -m 0770 -vp "$x";
chown -R ${cfg.user}:${cfg.group} "$x";
done
[ ! -d /etc/foundationdb ] && \
mkdir -m 0775 -vp /etc/foundationdb && \
chown -R ${cfg.user}:${cfg.group} "/etc/foundationdb"
if [ ! -f /etc/foundationdb/fdb.cluster ]; then
cf=/etc/foundationdb/fdb.cluster
desc=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
rand=$(tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c8)
echo ''${desc}:''${rand}@${initialIpAddr}:${builtins.toString cfg.listenPortStart} > $cf
chmod 0664 $cf && chown -R ${cfg.user}:${cfg.group} $cf
chmod 0664 $cf
touch "${cfg.dataDir}/.first_startup"
fi
'';

17
nixos/modules/services/databases/hbase.nix
View File

@ -94,6 +94,11 @@ in {
config = mkIf config.services.hbase.enable {
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -"
"d '${cfg.logDir}' - ${cfg.user} ${cfg.group} - -"
];
systemd.services.hbase = {
description = "HBase Server";
wantedBy = [ "multi-user.target" ];
@ -103,19 +108,7 @@ in {
HBASE_LOG_DIR = cfg.logDir;
};
preStart =
''
mkdir -p ${cfg.dataDir};
mkdir -p ${cfg.logDir};
if [ "$(id -u)" = 0 ]; then
chown ${cfg.user}:${cfg.group} ${cfg.dataDir}
chown ${cfg.user}:${cfg.group} ${cfg.logDir}
fi
'';
serviceConfig = {
PermissionsStartOnly = true;
User = cfg.user;
Group = cfg.group;
ExecStart = "${cfg.package}/bin/hbase --config ${configDir} master start";

12
nixos/modules/services/logging/graylog.nix
View File

@ -134,6 +134,10 @@ in
};
};
systemd.tmpfiles.rules = [
"d '${cfg.messageJournalDir}' - ${cfg.user} - - -"
];
systemd.services.graylog = with pkgs; {
description = "Graylog Server";
wantedBy = [ "multi-user.target" ];
@ -143,8 +147,6 @@ in
};
path = [ pkgs.jre_headless pkgs.which pkgs.procps ];
preStart = ''
mkdir -p /var/lib/graylog -m 755
rm -rf /var/lib/graylog/plugins || true
mkdir -p /var/lib/graylog/plugins -m 755
@ -154,14 +156,10 @@ in
for includedplugin in `ls ${cfg.package}/plugin/`; do
ln -s ${cfg.package}/plugin/$includedplugin /var/lib/graylog/plugins/$includedplugin || true
done
chown -R ${cfg.user} /var/lib/graylog
mkdir -p ${cfg.messageJournalDir} -m 755
chown -R ${cfg.user} ${cfg.messageJournalDir}
'';
serviceConfig = {
User="${cfg.user}";
PermissionsStartOnly=true;
StateDirectory = "graylog";
ExecStart = "${cfg.package}/bin/graylogctl run";
};
};

6
nixos/modules/services/logging/heartbeat.nix
View File

@ -54,16 +54,18 @@ in
config = mkIf cfg.enable {
systemd.tmpfiles.rules = [
"d '${cfg.stateDir}' - nobody nogroup - -"
];
systemd.services.heartbeat = with pkgs; {
description = "heartbeat log shipper";
wantedBy = [ "multi-user.target" ];
preStart = ''
mkdir -p "${cfg.stateDir}"/{data,logs}
chown nobody:nogroup "${cfg.stateDir}"/{data,logs}
'';
serviceConfig = {
User = "nobody";
PermissionsStartOnly = true;
AmbientCapabilities = "cap_net_raw";
ExecStart = "${pkgs.heartbeat}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
};

13
nixos/modules/services/mail/dspam.nix
View File

@ -113,19 +113,14 @@ in {
Group = cfg.group;
RuntimeDirectory = optional (cfg.domainSocket == defaultSock) "dspam";
RuntimeDirectoryMode = optional (cfg.domainSocket == defaultSock) "0750";
PermissionsStartOnly = true;
StateDirectory = "dspam";
StateDirectoryMode = "0750";
LogsDirectory = "dspam";
LogsDirectoryMode = "0750";
# DSPAM segfaults on just about every error
Restart = "on-abort";
RestartSec = "1s";
};
preStart = ''
mkdir -m750 -p /var/lib/dspam
chown -R "${cfg.user}:${cfg.group}" /var/lib/dspam
mkdir -m750 -p /var/log/dspam
chown -R "${cfg.user}:${cfg.group}" /var/log/dspam
'';
};
}

7
nixos/modules/services/mail/opendkim.nix
View File

@ -101,13 +101,16 @@ in {
environment.systemPackages = [ pkgs.opendkim ];
systemd.tmpfiles.rules = [
"d '${cfg.keyPath}' - ${cfg.user} ${cfg.group} - -"
];
systemd.services.opendkim = {
description = "OpenDKIM signing and verification daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
preStart = ''
mkdir -p "${cfg.keyPath}"
cd "${cfg.keyPath}"
if ! test -f ${cfg.selector}.private; then
${pkgs.opendkim}/bin/opendkim-genkey -s ${cfg.selector} -d all-domains-generic-key
@ -116,7 +119,6 @@ in {
cat ${cfg.selector}.txt
echo "-------------------------------------------------------------"
fi
chown ${cfg.user}:${cfg.group} ${cfg.selector}.private
'';
serviceConfig = {
@ -124,7 +126,6 @@ in {
User = cfg.user;
Group = cfg.group;
RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
PermissionsStartOnly = true;
};
};

9
nixos/modules/services/misc/apache-kafka.nix
View File

@ -131,6 +131,8 @@ in {
home = head cfg.logDirs;
};
systemd.tmpfiles.rules = map (logDir: "d '${logDir} 0700 apache-kafka - - -") cfg.logDirs;
systemd.services.apache-kafka = {
description = "Apache Kafka Daemon";
wantedBy = [ "multi-user.target" ];
@ -145,15 +147,8 @@ in {
${serverConfig}
'';
User = "apache-kafka";
PermissionsStartOnly = true;
SuccessExitStatus = "0 143";
};
preStart = ''
mkdir -m 0700 -p ${concatStringsSep " " cfg.logDirs}
if [ "$(id -u)" = 0 ]; then
chown apache-kafka ${concatStringsSep " " cfg.logDirs};
fi
'';
};
};

7
nixos/modules/services/misc/couchpotato.nix
View File

@ -19,16 +19,11 @@ in
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
preStart = ''
mkdir -p /var/lib/couchpotato
chown -R couchpotato:couchpotato /var/lib/couchpotato
'';
serviceConfig = {
Type = "simple";
User = "couchpotato";
Group = "couchpotato";
PermissionsStartOnly = "true";
StateDirectory = "couchpotato";
ExecStart = "${pkgs.couchpotato}/bin/couchpotato";
Restart = "on-failure";
};

15
nixos/modules/services/misc/gollum.nix
View File

@ -75,27 +75,24 @@ in
users.groups.gollum = { };
systemd.tmpfiles.rules = [
"d '${cfg.stateDir}' - ${config.users.users.gollum.name} ${config.users.groups.gollum.name} - -"
];
systemd.services.gollum = {
description = "Gollum wiki";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = [ pkgs.git ];
preStart = let
userName = config.users.users.gollum.name;
groupName = config.users.groups.gollum.name;
in ''
# All of this is safe to be run on an existing repo
mkdir -p ${cfg.stateDir}
preStart = ''
# This is safe to be run on an existing repo
git init ${cfg.stateDir}
chmod 755 ${cfg.stateDir}
chown -R ${userName}:${groupName} ${cfg.stateDir}
'';
serviceConfig = {
User = config.users.users.gollum.name;
Group = config.users.groups.gollum.name;
PermissionsStartOnly = true;
ExecStart = ''
${pkgs.gollum}/bin/gollum \
--port ${toString cfg.port} \

7
nixos/modules/services/misc/octoprint.nix
View File

@ -97,6 +97,10 @@ in
gid = config.ids.gids.octoprint;
});
systemd.tmpfiles.rules = [
"d '${cfg.stateDir}' - ${cfg.user} ${cfg.group} - -"
];
systemd.services.octoprint = {
description = "OctoPrint, web interface for 3D printers";
wantedBy = [ "multi-user.target" ];
@ -105,7 +109,6 @@ in
environment.PYTHONPATH = makeSearchPathOutput "lib" pkgs.python.sitePackages [ pluginsEnv ];
preStart = ''
mkdir -p "${cfg.stateDir}"
if [ -e "${cfg.stateDir}/config.yaml" ]; then
${pkgs.yaml-merge}/bin/yaml-merge "${cfg.stateDir}/config.yaml" "${cfgUpdate}" > "${cfg.stateDir}/config.yaml.tmp"
mv "${cfg.stateDir}/config.yaml.tmp" "${cfg.stateDir}/config.yaml"
@ -113,14 +116,12 @@ in
cp "${cfgUpdate}" "${cfg.stateDir}/config.yaml"
chmod 600 "${cfg.stateDir}/config.yaml"
fi
chown -R ${cfg.user}:${cfg.group} "${cfg.stateDir}"
'';
serviceConfig = {
ExecStart = "${pkgs.octoprint}/bin/octoprint serve -b ${cfg.stateDir}";
User = cfg.user;
Group = cfg.group;
PermissionsStartOnly = true;
};
};

9
nixos/modules/services/monitoring/alerta.nix
View File

@ -83,6 +83,10 @@ in
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules = [
"d '${cfg.logDir}' - alerta alerta - -"
];
systemd.services.alerta = {
description = "Alerta Monitoring System";
wantedBy = [ "multi-user.target" ];
@ -94,12 +98,7 @@ in
ExecStart = "${pkgs.python36Packages.alerta-server}/bin/alertad run --port ${toString cfg.port} --host ${cfg.bind}";
User = "alerta";
Group = "alerta";
PermissionsStartOnly = true;
};
preStart = ''
mkdir -p ${cfg.logDir}
chown alerta:alerta ${cfg.logDir}
'';
};
environment.systemPackages = [ pkgs.python36Packages.alerta ];

9
nixos/modules/services/monitoring/kapacitor.nix
View File

@ -163,6 +163,10 @@ in
config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.kapacitor ];
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -"
];
systemd.services.kapacitor = {
description = "Kapacitor Real-Time Stream Processing Engine";
wantedBy = [ "multi-user.target" ];
@ -171,12 +175,7 @@ in
ExecStart = "${pkgs.kapacitor}/bin/kapacitord -config ${kapacitorConf}";
User = "kapacitor";
Group = "kapacitor";
PermissionsStartOnly = true;
};
preStart = ''
mkdir -p ${cfg.dataDir}
chown ${cfg.user}:${cfg.group} ${cfg.dataDir}
'';
};
users.users.kapacitor = {

1
nixos/modules/services/monitoring/netdata.nix
View File

@ -143,7 +143,6 @@ in {
User = cfg.user;
Group = cfg.group;
Environment="PYTHONPATH=${pkgs.netdata}/libexec/netdata/python.d/python_modules";
PermissionsStartOnly = true;
ExecStart = "${pkgs.netdata}/bin/netdata -D -c ${configFile}";
TimeoutStopSec = 60;
};

8
nixos/modules/services/monitoring/riemann-dash.nix
View File

@ -59,18 +59,20 @@ in {
group = "riemanndash";
};
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - riemanndash riemanndash - -"
];
systemd.services.riemann-dash = {
wantedBy = [ "multi-user.target" ];
wants = [ "riemann.service" ];
after = [ "riemann.service" ];
preStart = ''
mkdir -p ${cfg.dataDir}/config
chown -R riemanndash:riemanndash ${cfg.dataDir}
mkdir -p '${cfg.dataDir}/config'
'';
serviceConfig = {
User = "riemanndash";
ExecStart = "${launcher}/bin/riemann-dash";
PermissionsStartOnly = true;
};
};

1
nixos/modules/services/monitoring/riemann-tools.nix
View File

@ -54,7 +54,6 @@ in {
serviceConfig = {
User = "riemanntools";
ExecStart = "${healthLauncher}/bin/riemann-health";
PermissionsStartOnly = true;
};
};

1
nixos/modules/services/monitoring/scollector.nix
View File

@ -116,7 +116,6 @@ in {
path = [ pkgs.coreutils pkgs.iproute ];
serviceConfig = {
PermissionsStartOnly = true;
User = cfg.user;
Group = cfg.group;
ExecStart = "${cfg.package.bin}/bin/scollector -conf=${conf} ${lib.concatStringsSep " " cfg.extraOpts}";

14
nixos/modules/services/networking/aria2.nix
View File

@ -102,22 +102,19 @@ in
users.groups.aria2.gid = config.ids.gids.aria2;
systemd.tmpfiles.rules = [
"d '${homeDir}' 0770 aria2 aria2 - -"
"d '${config.services.aria2.downloadDir}' 0770 aria2 aria2 - -"
];
systemd.services.aria2 = {
description = "aria2 Service";
after = [ "local-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
preStart = ''
mkdir -m 0770 -p "${homeDir}"
chown aria2:aria2 "${homeDir}"
if [[ ! -d "${config.services.aria2.downloadDir}" ]]
then
mkdir -m 0770 -p "${config.services.aria2.downloadDir}"
chown aria2:aria2 "${config.services.aria2.downloadDir}"
fi
if [[ ! -e "${sessionFile}" ]]
then
touch "${sessionFile}"
chown aria2:aria2 "${sessionFile}"
fi
cp -f "${settingsFile}" "${settingsDir}/aria2.conf"
'';
@ -128,7 +125,6 @@ in
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
User = "aria2";
Group = "aria2";
PermissionsStartOnly = true;
};
};
};

1
nixos/modules/services/networking/autossh.nix
View File

@ -99,7 +99,6 @@ in
serviceConfig = {
User = "${s.user}";
PermissionsStartOnly = true;
# AutoSSH may exit with 0 code if the SSH session was
# gracefully terminated by either local or remote side.
Restart = "on-success";

9
nixos/modules/services/networking/charybdis.nix
View File

@ -83,6 +83,10 @@ in
gid = config.ids.gids.ircd;
};
systemd.tmpfiles.rules = [
"d ${cfg.statedir} - ${cfg.user} ${cfg.group} - -"
];
systemd.services.charybdis = {
description = "Charybdis IRC daemon";
wantedBy = [ "multi-user.target" ];
@ -93,12 +97,7 @@ in
ExecStart = "${charybdis}/bin/charybdis -foreground -logfile /dev/stdout -configfile ${configFile}";
Group = cfg.group;
User = cfg.user;
PermissionsStartOnly = true; # preStart needs to run with root permissions
};
preStart = ''
${coreutils}/bin/mkdir -p ${cfg.statedir}
${coreutils}/bin/chown ${cfg.user}:${cfg.group} ${cfg.statedir}
'';
};
}

8
nixos/modules/services/networking/minidlna.nix
View File

@ -98,16 +98,10 @@ in
wantedBy = [ "multi-user.target" ];
after = [ "network.target" "local-fs.target" ];
preStart =
''
mkdir -p /var/cache/minidlna
chown -R minidlna:minidlna /var/cache/minidlna
'';
serviceConfig =
{ User = "minidlna";
Group = "minidlna";
PermissionsStartOnly = true;
CacheDirectory = "minidlna";
RuntimeDirectory = "minidlna";
PIDFile = "/run/minidlna/pid";
ExecStart =

10
nixos/modules/services/networking/quassel.nix
View File

@ -104,6 +104,10 @@ in
gid = config.ids.gids.quassel;
}];
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - ${user} - - -"
];
systemd.services.quassel =
{ description = "Quassel IRC client daemon";
@ -111,11 +115,6 @@ in
after = [ "network.target" ] ++ optional config.services.postgresql.enable "postgresql.service"
++ optional config.services.mysql.enable "mysql.service";
preStart = ''
mkdir -p ${cfg.dataDir}
chown ${user} ${cfg.dataDir}
'';
serviceConfig =
{
ExecStart = concatStringsSep " " ([
@ -126,7 +125,6 @@ in
] ++ optional cfg.requireSSL "--require-ssl"
++ optional (cfg.certificateFile != null) "--ssl-cert=${cfg.certificateFile}");
User = user;
PermissionsStartOnly = true;
};
};

1
nixos/modules/services/networking/squid.nix
View File

@ -159,7 +159,6 @@ in
serviceConfig = {
Type="forking";
PIDFile="/run/squid.pid";
PermissionsStartOnly = true;
ExecStart = "${pkgs.squid}/bin/squid -YCs -f ${squidConfig}";
};
};

10
nixos/modules/services/networking/teamspeak3.nix
View File

@ -111,16 +111,15 @@ in
gid = config.ids.gids.teamspeak;
};
systemd.tmpfiles.rules = [
"d '${cfg.logPath}' - ${user} ${group} - -"
];
systemd.services.teamspeak3-server = {
description = "Teamspeak3 voice communication server daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
preStart = ''
mkdir -p ${cfg.logPath}
chown ${user}:${group} ${cfg.logPath}
'';
serviceConfig = {
ExecStart = ''
${ts3}/bin/ts3server \
@ -135,7 +134,6 @@ in
WorkingDirectory = cfg.dataDir;
User = user;
Group = group;
PermissionsStartOnly = true;
};
};
};

11
nixos/modules/services/networking/unifi.nix
View File

@ -146,6 +146,11 @@ in
where = where;
}) mountPoints;
systemd.tmpfiles.rules = [
"e '${stateDir}' 0700 unifi - - -"
"e '${stateDir}/data' 0700 unifi - - -"
];
systemd.services.unifi = {
description = "UniFi controller daemon";
wantedBy = [ "multi-user.target" ];
@ -157,14 +162,9 @@ in
environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
preStart = ''
# Ensure privacy of state and data.
chown unifi "${stateDir}" "${stateDir}/data"
chmod 0700 "${stateDir}" "${stateDir}/data"
# Create the volatile webapps
rm -rf "${stateDir}/webapps"
mkdir -p "${stateDir}/webapps"
chown unifi "${stateDir}/webapps"
ln -s "${cfg.unifiPackage}/webapps/ROOT" "${stateDir}/webapps/ROOT"
'';
@ -177,7 +177,6 @@ in
ExecStart = "${(removeSuffix "\n" cmd)} start";
ExecStop = "${(removeSuffix "\n" cmd)} stop";
User = "unifi";
PermissionsStartOnly = true;
UMask = "0077";
WorkingDirectory = "${stateDir}";
};

13
nixos/modules/services/networking/zeronet.nix
View File

@ -86,20 +86,17 @@ in with lib; {
'';
};
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' 750 zeronet zeronet - -"
"d '${cfg.logDir}' 750 zeronet zeronet - -"
];
systemd.services.zeronet = {
description = "zeronet";
after = [ "network.target" (optionalString cfg.tor "tor.service") ];
wantedBy = [ "multi-user.target" ];
preStart = ''
# Ensure folder exists or create it and permissions are correct
mkdir -p ${escapeShellArg cfg.dataDir} ${escapeShellArg cfg.logDir}
chmod 750 ${escapeShellArg cfg.dataDir} ${escapeShellArg cfg.logDir}
chown zeronet:zeronet ${escapeShellArg cfg.dataDir} ${escapeShellArg cfg.logDir}
'';
serviceConfig = {
PermissionsStartOnly = true;
PrivateTmp = "yes";
User = "zeronet";
Group = "zeronet";

18
nixos/modules/services/web-apps/atlassian/confluence.nix
View File

@ -149,6 +149,17 @@ in
users.groups."${cfg.group}" = {};
systemd.tmpfiles.rules = [
"d '${cfg.home}' - ${cfg.user} - - -"
"d /run/confluence - - - - -"
"L+ /run/confluence/home - - - - ${cfg.home}"
"L+ /run/confluence/logs - - - - ${cfg.home}/logs"
"L+ /run/confluence/temp - - - - ${cfg.home}/temp"
"L+ /run/confluence/work - - - - ${cfg.home}/work"
"L+ /run/confluence/server.xml - - - - ${cfg.home}/server.xml"
];
systemd.services.confluence = {
description = "Atlassian Confluence";
@ -167,12 +178,6 @@ in
preStart = ''
mkdir -p ${cfg.home}/{logs,work,temp,deploy}
mkdir -p /run/confluence
ln -sf ${cfg.home}/{logs,work,temp,server.xml} /run/confluence
ln -sf ${cfg.home} /run/confluence/home
chown ${cfg.user} ${cfg.home}
sed -e 's,port="8090",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
'' + (lib.optionalString cfg.proxy.enable ''
-e 's,protocol="org.apache.coyote.http11.Http11NioProtocol",protocol="org.apache.coyote.http11.Http11NioProtocol" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}",' \
@ -184,7 +189,6 @@ in
User = cfg.user;
Group = cfg.group;
PrivateTmp = true;
PermissionsStartOnly = true;
ExecStart = "${pkg}/bin/start-confluence.sh -fg";
ExecStop = "${pkg}/bin/stop-confluence.sh";
};

17
nixos/modules/services/web-apps/atlassian/crowd.nix
View File

@ -117,6 +117,16 @@ in
users.groups."${cfg.group}" = {};
systemd.tmpfiles.rules = [
"d '${cfg.home}' - ${cfg.user} ${cfg.group} - -"
"d /run/atlassian-crowd - - - - -"
"L+ /run/atlassian-crowd/database - - - - ${cfg.home}/database"
"L+ /run/atlassian-crowd/logs - - - - ${cfg.home}/logs"
"L+ /run/atlassian-crowd/work - - - - ${cfg.home}/work"
"L+ /run/atlassian-crowd/server.xml - - - - ${cfg.home}/server.xml"
];
systemd.services.atlassian-crowd = {
description = "Atlassian Crowd";
@ -136,12 +146,6 @@ in
rm -rf ${cfg.home}/work
mkdir -p ${cfg.home}/{logs,database,work}
mkdir -p /run/atlassian-crowd
ln -sf ${cfg.home}/{database,logs,work,server.xml} /run/atlassian-crowd
chown ${cfg.user}:${cfg.group} ${cfg.home}
chown ${cfg.user}:${cfg.group} ${cfg.home}/{logs,database,work}
sed -e 's,port="8095",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
'' + (lib.optionalString cfg.proxy.enable ''
-e 's,compression="on",compression="off" protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${boolToString cfg.proxy.secure}",' \
@ -153,7 +157,6 @@ in
User = cfg.user;
Group = cfg.group;
PrivateTmp = true;
PermissionsStartOnly = true;
ExecStart = "${pkg}/start_crowd.sh -fg";
};
};

18
nixos/modules/services/web-apps/atlassian/jira.nix
View File

@ -155,6 +155,17 @@ in
users.groups."${cfg.group}" = {};
systemd.tmpfiles.rules = [
"d '${cfg.home}' - ${cfg.user} - - -"
"d /run/atlassian-jira - - - - -"
"L+ /run/atlassian-jira/home - - - - ${cfg.home}"
"L+ /run/atlassian-jira/logs - - - - ${cfg.home}/logs"
"L+ /run/atlassian-jira/work - - - - ${cfg.home}/work"
"L+ /run/atlassian-jira/temp - - - - ${cfg.home}/temp"
"L+ /run/atlassian-jira/server.xml - - - - ${cfg.home}/server.xml"
];
systemd.services.atlassian-jira = {
description = "Atlassian JIRA";
@ -174,12 +185,6 @@ in
preStart = ''
mkdir -p ${cfg.home}/{logs,work,temp,deploy}
mkdir -p /run/atlassian-jira
ln -sf ${cfg.home}/{logs,work,temp,server.xml} /run/atlassian-jira
ln -sf ${cfg.home} /run/atlassian-jira/home
chown ${cfg.user} ${cfg.home}
sed -e 's,port="8080",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
'' + (lib.optionalString cfg.proxy.enable ''
-e 's,protocol="HTTP/1.1",protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${toString cfg.proxy.secure}",' \
@ -191,7 +196,6 @@ in
User = cfg.user;
Group = cfg.group;
PrivateTmp = true;
PermissionsStartOnly = true;
ExecStart = "${pkg}/bin/start-jira.sh -fg";
ExecStop = "${pkg}/bin/stop-jira.sh";
};

10
nixos/modules/services/web-apps/frab.nix
View File

@ -182,16 +182,16 @@ in
users.groups = [ { name = cfg.group; } ];
systemd.tmpfiles.rules = [
"d '${cfg.statePath}/system/attachments' - ${cfg.user} ${cfg.group} - -"
];
systemd.services.frab = {
after = [ "network.target" "gitlab.service" ];
wantedBy = [ "multi-user.target" ];
environment = frabEnv;
preStart = ''
mkdir -p ${cfg.statePath}/system/attachments
chown ${cfg.user}:${cfg.group} -R ${cfg.statePath}
mkdir /run/frab -p
ln -sf ${pkgs.writeText "frab-database.yml" databaseConfig} /run/frab/database.yml
ln -sf ${cfg.statePath}/system /run/frab/system
@ -204,7 +204,6 @@ in
'';
serviceConfig = {
PermissionsStartOnly = true;
PrivateTmp = true;
PrivateDevices = true;
Type = "simple";
@ -213,6 +212,7 @@ in
TimeoutSec = "300s";
Restart = "on-failure";
RestartSec = "10s";
RuntimeDirectory = "frab";
WorkingDirectory = "${package}/share/frab";
ExecStart = "${frab-rake}/bin/frab-bundle exec rails server " +
"--binding=${cfg.listenAddress} --port=${toString cfg.listenPort}";