Merge pull request #164377 from rsynnest/master
nixos/unifi-video: add deprecation warning for openFirewall
This commit is contained in:
pennae
GitHub
commit
e7da834115
@ -1411,6 +1411,15 @@
|
||||
using this default will print a warning when rebuilt.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>services.unifi-video.openPorts</literal> option
|
||||
default value of <literal>true</literal> is now deprecated and
|
||||
will be changed to <literal>false</literal> in 22.11.
|
||||
Configurations using this default will print a warning when
|
||||
rebuilt.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>security.acme</literal> certificates will now
|
||||
|
||||
@ -506,6 +506,9 @@ In addition to numerous new and upgraded packages, this release has the followin
|
||||
- The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
|
||||
Configurations using this default will print a warning when rebuilt.
|
||||
|
||||
- The `services.unifi-video.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11.
|
||||
Configurations using this default will print a warning when rebuilt.
|
||||
|
||||
- `security.acme` certificates will now correctly check for CA
|
||||
revokation before reaching their minimum age.
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ let
|
||||
-pidfile ${cfg.pidFile} \
|
||||
-procname unifi-video \
|
||||
-Djava.security.egd=file:/dev/./urandom \
|
||||
-Xmx${cfg.maximumJavaHeapSize}M \
|
||||
-Xmx${toString cfg.maximumJavaHeapSize}M \
|
||||
-Xss512K \
|
||||
-XX:+UseG1GC \
|
||||
-XX:+UseStringDeduplication \
|
||||
@ -91,98 +91,102 @@ let
|
||||
stateDir = "/var/lib/unifi-video";
|
||||
|
||||
in
|
||||
{
|
||||
{
|
||||
|
||||
options.services.unifi-video = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether or not to enable the unifi-video service.
|
||||
'';
|
||||
};
|
||||
options.services.unifi-video = {
|
||||
|
||||
jrePackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.jre8;
|
||||
defaultText = literalExpression "pkgs.jre8";
|
||||
description = ''
|
||||
The JRE package to use. Check the release notes to ensure it is supported.
|
||||
'';
|
||||
};
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether or not to enable the unifi-video service.
|
||||
'';
|
||||
};
|
||||
|
||||
unifiVideoPackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.unifi-video;
|
||||
defaultText = literalExpression "pkgs.unifi-video";
|
||||
description = ''
|
||||
The unifi-video package to use.
|
||||
'';
|
||||
};
|
||||
jrePackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.jre8;
|
||||
defaultText = literalExpression "pkgs.jre8";
|
||||
description = ''
|
||||
The JRE package to use. Check the release notes to ensure it is supported.
|
||||
'';
|
||||
};
|
||||
|
||||
mongodbPackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.mongodb-4_0;
|
||||
defaultText = literalExpression "pkgs.mongodb";
|
||||
description = ''
|
||||
The mongodb package to use.
|
||||
'';
|
||||
};
|
||||
unifiVideoPackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.unifi-video;
|
||||
defaultText = literalExpression "pkgs.unifi-video";
|
||||
description = ''
|
||||
The unifi-video package to use.
|
||||
'';
|
||||
};
|
||||
|
||||
logDir = mkOption {
|
||||
type = types.str;
|
||||
default = "${stateDir}/logs";
|
||||
description = ''
|
||||
Where to store the logs.
|
||||
'';
|
||||
};
|
||||
mongodbPackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.mongodb-4_0;
|
||||
defaultText = literalExpression "pkgs.mongodb";
|
||||
description = ''
|
||||
The mongodb package to use.
|
||||
'';
|
||||
};
|
||||
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "${stateDir}/data";
|
||||
description = ''
|
||||
Where to store the database and other data.
|
||||
'';
|
||||
};
|
||||
logDir = mkOption {
|
||||
type = types.str;
|
||||
default = "${stateDir}/logs";
|
||||
description = ''
|
||||
Where to store the logs.
|
||||
'';
|
||||
};
|
||||
|
||||
openPorts = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether or not to open the required ports on the firewall.
|
||||
'';
|
||||
};
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "${stateDir}/data";
|
||||
description = ''
|
||||
Where to store the database and other data.
|
||||
'';
|
||||
};
|
||||
|
||||
maximumJavaHeapSize = mkOption {
|
||||
type = types.nullOr types.int;
|
||||
default = 1024;
|
||||
example = 4096;
|
||||
description = ''
|
||||
Set the maximimum heap size for the JVM in MB.
|
||||
'';
|
||||
};
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether or not to open the required ports on the firewall.
|
||||
'';
|
||||
};
|
||||
|
||||
pidFile = mkOption {
|
||||
type = types.path;
|
||||
default = "${cfg.dataDir}/unifi-video.pid";
|
||||
defaultText = literalExpression ''"''${config.${opt.dataDir}}/unifi-video.pid"'';
|
||||
description = "Location of unifi-video pid file.";
|
||||
};
|
||||
maximumJavaHeapSize = mkOption {
|
||||
type = types.nullOr types.int;
|
||||
default = 1024;
|
||||
example = 4096;
|
||||
description = ''
|
||||
Set the maximimum heap size for the JVM in MB.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
pidFile = mkOption {
|
||||
type = types.path;
|
||||
default = "${cfg.dataDir}/unifi-video.pid";
|
||||
defaultText = literalExpression ''"''${config.${opt.dataDir}}/unifi-video.pid"'';
|
||||
description = "Location of unifi-video pid file.";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
users = {
|
||||
users.unifi-video = {
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
warnings = optional
|
||||
(options.services.unifi-video.openFirewall.highestPrio >= (mkOptionDefault null).priority)
|
||||
"The current services.unifi-video.openFirewall = true default is deprecated and will change to false in 22.11. Set it explicitly to silence this warning.";
|
||||
|
||||
users.users.unifi-video = {
|
||||
description = "UniFi Video controller daemon user";
|
||||
home = stateDir;
|
||||
group = "unifi-video";
|
||||
isSystemUser = true;
|
||||
};
|
||||
groups.unifi-video = {};
|
||||
};
|
||||
users.groups.unifi-video = {};
|
||||
|
||||
networking.firewall = mkIf cfg.openPorts {
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
# https://help.ui.com/hc/en-us/articles/217875218-UniFi-Video-Ports-Used
|
||||
allowedTCPPorts = [
|
||||
7080 # HTTP portal
|
||||
@ -237,7 +241,6 @@ config = mkIf cfg.enable {
|
||||
"L+ '${stateDir}/conf/server.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/server.xml"
|
||||
"L+ '${stateDir}/conf/tomcat-users.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/tomcat-users.xml"
|
||||
"L+ '${stateDir}/conf/web.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/web.xml"
|
||||
|
||||
];
|
||||
|
||||
systemd.services.unifi-video = {
|
||||
@ -258,10 +261,11 @@ config = mkIf cfg.enable {
|
||||
WorkingDirectory = "${stateDir}";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
meta = {
|
||||
maintainers = with lib.maintainers; [ rsynnest ];
|
||||
};
|
||||
imports = [
|
||||
(mkRenamedOptionModule [ "services" "unifi-video" "openPorts" ] [ "services" "unifi-video" "openFirewall" ])
|
||||
];
|
||||
|
||||
meta.maintainers = with lib.maintainers; [ rsynnest ];
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user