nix module updates
This commit is contained in:
parent
1fc0ecad20
commit
495aee464d
SSH Key Fingerprint:
SHA256:NFjjdbkd6u7aoMlcrDCVvz6o2UBtlAuPm8IQ2vhZ3Fg
12
flake.lock
12
flake.lock
|
|
@ -20,11 +20,11 @@
|
|||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1710146030,
|
||||
"narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
|
||||
"lastModified": 1726560853,
|
||||
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
|
||||
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -35,11 +35,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1725534445,
|
||||
"narHash": "sha256-Yd0FK9SkWy+ZPuNqUgmVPXokxDgMJoGuNpMEtkfcf84=",
|
||||
"lastModified": 1726871744,
|
||||
"narHash": "sha256-V5LpfdHyQkUF7RfOaDPrZDP+oqz88lTJrMT1+stXNwo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9bb1e7571aadf31ddb4af77fc64b2d59580f9a39",
|
||||
"rev": "a1d92660c6b3b7c26fb883500a80ea9d33321be2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
87
flake.nix
87
flake.nix
|
|
@ -7,15 +7,14 @@
|
|||
flake-utils.url = "github:numtide/flake-utils";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{ self
|
||||
, nixpkgs
|
||||
, crane
|
||||
, flake-utils
|
||||
, ...
|
||||
outputs = {
|
||||
self,
|
||||
nixpkgs,
|
||||
crane,
|
||||
flake-utils,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
|
||||
craneLib = crane.mkLib pkgs;
|
||||
|
|
@ -44,8 +43,7 @@
|
|||
# here *without* rebuilding all dependency crates
|
||||
# MY_CUSTOM_VAR = "some value";
|
||||
});
|
||||
in
|
||||
{
|
||||
in {
|
||||
checks = {
|
||||
inherit breeze;
|
||||
};
|
||||
|
|
@ -70,17 +68,16 @@
|
|||
];
|
||||
};
|
||||
|
||||
nixosModules.breeze =
|
||||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
nixosModules.breeze = {
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.services.breeze;
|
||||
settingsFormat = pkgs.formats.toml { };
|
||||
in
|
||||
{
|
||||
settingsFormat = pkgs.formats.toml {};
|
||||
in {
|
||||
options = {
|
||||
services.breeze = {
|
||||
enable = mkEnableOption "breeze file server";
|
||||
|
|
@ -105,18 +102,36 @@
|
|||
|
||||
extraGroups = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
description = "Supplementary groups";
|
||||
default = [];
|
||||
description = "Any supplementary groups for `breeze` to run under";
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = settingsFormat.type;
|
||||
default = { };
|
||||
default = {};
|
||||
description = ''
|
||||
The *.toml configuration to run `breeze` with.
|
||||
There is no formal documentation, but there is an example in the [readme](https://git.min.rip/min/breeze/src/branch/main/README.md).
|
||||
'';
|
||||
};
|
||||
|
||||
configDir = mkOption {
|
||||
type = types.path;
|
||||
default = "/etc/breeze";
|
||||
description = ''
|
||||
The directory on disk to store the `breeze` config file in.
|
||||
This does not load pre-existing config files, it only defines where the generated config is saved.
|
||||
'';
|
||||
};
|
||||
|
||||
uploadKeyFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
File to load the `engine.upload_key` from, if desired.
|
||||
This is useful for loading it from a secret management system.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -126,12 +141,30 @@
|
|||
inherit (cfg) group;
|
||||
};
|
||||
|
||||
users.groups.${cfg.group} = { };
|
||||
users.groups.${cfg.group} = {};
|
||||
|
||||
systemd.services.breeze = {
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${cfg.configDir}' 0750 ${cfg.user} ${cfg.group} - -"
|
||||
];
|
||||
|
||||
services.breeze.settings = mkMerge [
|
||||
(mkIf (cfg.uploadKeyFile != null) {engine.upload_key = "@UPLOAD_KEY@";})
|
||||
];
|
||||
|
||||
systemd.services.breeze = let
|
||||
cfgFile = "${cfg.configDir}/breeze.toml";
|
||||
in {
|
||||
description = "breeze file server";
|
||||
after = [ "local-fs.target" "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = ["local-fs.target" "network.target"];
|
||||
wantedBy = ["multi-user.target"];
|
||||
|
||||
preStart =
|
||||
''
|
||||
install -m 660 ${settingsFormat.generate "breeze.toml" cfg.settings} ${cfgFile}
|
||||
''
|
||||
+ lib.optionalString (cfg.uploadKeyFile != null) ''
|
||||
${pkgs.replace-secret}/bin/replace-secret '@UPLOAD_KEY@' "${cfg.uploadKeyFile}" ${cfgFile}
|
||||
'';
|
||||
|
||||
serviceConfig = rec {
|
||||
User = cfg.user;
|
||||
|
|
@ -143,7 +176,7 @@
|
|||
ExecStart = escapeShellArgs [
|
||||
"${cfg.package}/bin/breeze"
|
||||
"--config"
|
||||
(settingsFormat.generate "breeze.toml" cfg.settings)
|
||||
cfgFile
|
||||
];
|
||||
Restart = "on-failure";
|
||||
|
||||
|
|
@ -171,7 +204,7 @@
|
|||
ProtectKernelTunables = true;
|
||||
|
||||
RestrictNamespaces = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true; # implied by DynamicUser
|
||||
|
||||
|
|
|
|||
113
nix/module.nix
113
nix/module.nix
|
|
@ -1,113 +0,0 @@
|
|||
{ config
|
||||
, pkgs
|
||||
, lib
|
||||
, ...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.services.breeze;
|
||||
settingsFormat = pkgs.formats.toml { };
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.breeze = {
|
||||
enable = mkEnableOption "breeze file server";
|
||||
|
||||
package = mkPackageOption self.packages.${system} "breeze";
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "breeze";
|
||||
description = "User that `breeze` will run under";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "breeze";
|
||||
description = "Group that `breeze` will run under";
|
||||
};
|
||||
|
||||
extraGroups = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
description = "Supplementary groups";
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = settingsFormat.type;
|
||||
default = { };
|
||||
description = ''
|
||||
The *.toml configuration to run `breeze` with.
|
||||
There is no formal documentation, but there is an example in the [readme](https://git.min.rip/min/breeze/src/branch/main/README.md).
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
users.users.${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
inherit (cfg) group;
|
||||
};
|
||||
|
||||
users.groups.${cfg.group} = { };
|
||||
|
||||
systemd.services.breeze = {
|
||||
description = "breeze file server";
|
||||
after = [ "local-fs.target" "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = rec {
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
DynamicUser = false; # we write files, so don't do that
|
||||
SupplementaryGroups = cfg.extraGroups;
|
||||
StateDirectory = "breeze";
|
||||
CacheDirectory = "breeze";
|
||||
ExecStart = escapeShellArgs [
|
||||
"${cfg.package}/bin/breeze"
|
||||
"--config"
|
||||
(settingsFormat.generate "breeze.toml" cfg.settings)
|
||||
];
|
||||
Restart = "on-failure";
|
||||
|
||||
# Security Options #
|
||||
|
||||
NoNewPrivileges = true; # implied by DynamicUser
|
||||
RemoveIPC = true; # implied by DynamicUser
|
||||
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
|
||||
DeviceAllow = "";
|
||||
|
||||
LockPersonality = true;
|
||||
|
||||
PrivateTmp = true; # implied by DynamicUser
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
|
||||
RestrictNamespaces = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true; # implied by DynamicUser
|
||||
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@keyring"
|
||||
"~@memlock"
|
||||
"~@privileged"
|
||||
"~@setuid"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue