nixos/unifi: refactor mountpoints
Use service internal bind mounts instead of global ones. This also moves the logs to /var/log/unifi on the host and the run directory to /run/unifi. Closes #61424
This commit is contained in:
parent
79ea7aa9f9
commit
0f60c45e9c
|
@ -1817,6 +1817,39 @@ Superuser created successfully.
|
|||
</listitem>
|
||||
</itemizedlist>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The
|
||||
<link xlink:href="options.html#opt-services.unifi.enable">services.unifi</link>
|
||||
module has been reworked, solving a number of issues. This
|
||||
leads to several user facing changes:
|
||||
</para>
|
||||
<itemizedlist spacing="compact">
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>services.unifi.dataDir</literal> option is
|
||||
removed and the data is now always located under
|
||||
<literal>/var/lib/unifi/data</literal>. This is done to
|
||||
make better use of systemd state direcotiry and thus
|
||||
making the service restart more reliable.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The unifi logs can now be found under:
|
||||
<literal>/var/log/unifi</literal> instead of
|
||||
<literal>/var/lib/unifi/logs</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The unifi run directory can now be found under:
|
||||
<literal>/run/unifi</literal> instead of
|
||||
<literal>/var/lib/unifi/run</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
</section>
|
||||
|
|
|
@ -509,3 +509,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
- Dokuwiki now supports caddy! However
|
||||
- the nginx option has been removed, in the new configuration, please use the `dokuwiki.webserver = "nginx"` instead.
|
||||
- The "${hostname}" option has been deprecated, please use `dokuwiki.sites = [ "${hostname}" ]` instead
|
||||
|
||||
- The [services.unifi](options.html#opt-services.unifi.enable) module has been reworked, solving a number of issues. This leads to several user facing changes:
|
||||
- The `services.unifi.dataDir` option is removed and the data is now always located under `/var/lib/unifi/data`. This is done to make better use of systemd state direcotiry and thus making the service restart more reliable.
|
||||
- The unifi logs can now be found under: `/var/log/unifi` instead of `/var/lib/unifi/logs`.
|
||||
- The unifi run directory can now be found under: `/run/unifi` instead of `/var/lib/unifi/run`.
|
||||
|
|
|
@ -9,25 +9,6 @@ let
|
|||
${optionalString (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m"} \
|
||||
-jar ${stateDir}/lib/ace.jar
|
||||
'';
|
||||
mountPoints = [
|
||||
{
|
||||
what = "${cfg.unifiPackage}/dl";
|
||||
where = "${stateDir}/dl";
|
||||
}
|
||||
{
|
||||
what = "${cfg.unifiPackage}/lib";
|
||||
where = "${stateDir}/lib";
|
||||
}
|
||||
{
|
||||
what = "${cfg.mongodbPackage}/bin";
|
||||
where = "${stateDir}/bin";
|
||||
}
|
||||
{
|
||||
what = "${cfg.dataDir}";
|
||||
where = "${stateDir}/data";
|
||||
}
|
||||
];
|
||||
systemdMountPoints = map (m: "${utils.escapeSystemdPath m.where}.mount") mountPoints;
|
||||
in
|
||||
{
|
||||
|
||||
|
@ -68,16 +49,6 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
services.unifi.dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "${stateDir}/data";
|
||||
description = ''
|
||||
Where to store the database and other data.
|
||||
|
||||
This directory will be bind-mounted to ${stateDir}/data as part of the service startup.
|
||||
'';
|
||||
};
|
||||
|
||||
services.unifi.openPorts = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
|
@ -136,32 +107,11 @@ in
|
|||
];
|
||||
};
|
||||
|
||||
# We must create the binary directories as bind mounts instead of symlinks
|
||||
# This is because the controller resolves all symlinks to absolute paths
|
||||
# to be used as the working directory.
|
||||
systemd.mounts = map ({ what, where }: {
|
||||
bindsTo = [ "unifi.service" ];
|
||||
partOf = [ "unifi.service" ];
|
||||
unitConfig.RequiresMountsFor = stateDir;
|
||||
options = "bind";
|
||||
what = what;
|
||||
where = where;
|
||||
}) mountPoints;
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${stateDir}' 0700 unifi - - -"
|
||||
"d '${stateDir}/data' 0700 unifi - - -"
|
||||
"d '${stateDir}/webapps' 0700 unifi - - -"
|
||||
"L+ '${stateDir}/webapps/ROOT' - - - - ${cfg.unifiPackage}/webapps/ROOT"
|
||||
];
|
||||
|
||||
systemd.services.unifi = {
|
||||
description = "UniFi controller daemon";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ] ++ systemdMountPoints;
|
||||
partOf = systemdMountPoints;
|
||||
bindsTo = systemdMountPoints;
|
||||
unitConfig.RequiresMountsFor = stateDir;
|
||||
after = [ "network.target" ];
|
||||
|
||||
# This a HACK to fix missing dependencies of dynamic libs extracted from jars
|
||||
environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
|
||||
# Make sure package upgrades trigger a service restart
|
||||
|
@ -209,8 +159,27 @@ in
|
|||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = [ "@system-service" ];
|
||||
|
||||
# Required for ProtectSystem=strict
|
||||
BindPaths = [ stateDir ];
|
||||
StateDirectory = "unifi";
|
||||
RuntimeDirectory = "unifi";
|
||||
LogsDirectory = "unifi";
|
||||
CacheDirectory= "unifi";
|
||||
|
||||
TemporaryFileSystem = [
|
||||
# required as we want to create bind mounts below
|
||||
"${stateDir}/webapps:rw"
|
||||
];
|
||||
|
||||
# We must create the binary directories as bind mounts instead of symlinks
|
||||
# This is because the controller resolves all symlinks to absolute paths
|
||||
# to be used as the working directory.
|
||||
BindPaths = [
|
||||
"/var/log/unifi:${stateDir}/logs"
|
||||
"/run/unifi:${stateDir}/run"
|
||||
"${cfg.unifiPackage}/dl:${stateDir}/dl"
|
||||
"${cfg.unifiPackage}/lib:${stateDir}/lib"
|
||||
"${cfg.mongodbPackage}/bin:${stateDir}/bin"
|
||||
"${cfg.unifiPackage}/webapps/ROOT:${stateDir}/webapps/ROOT"
|
||||
];
|
||||
|
||||
# Needs network access
|
||||
PrivateNetwork = false;
|
||||
|
@ -220,6 +189,9 @@ in
|
|||
};
|
||||
|
||||
};
|
||||
imports = [
|
||||
(mkRemovedOptionModule [ "services" "unifi" "dataDir" ] "You should move contents of dataDir to /var/lib/unifi/data" )
|
||||
];
|
||||
|
||||
meta.maintainers = with lib.maintainers; [ erictapen pennae ];
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue