Merge pull request #178154 from aanderse/nixos/prosody
nixos/prosody: conditionally provision required directories with StateDirectory
This commit is contained in:
commit
28562b800e
|
@ -511,8 +511,13 @@ in
|
||||||
|
|
||||||
dataDir = mkOption {
|
dataDir = mkOption {
|
||||||
type = types.path;
|
type = types.path;
|
||||||
description = "Directory where Prosody stores its data";
|
|
||||||
default = "/var/lib/prosody";
|
default = "/var/lib/prosody";
|
||||||
|
description = ''
|
||||||
|
The prosody home directory used to store all data. If left as the default value
|
||||||
|
this directory will automatically be created before the prosody server starts, otherwise
|
||||||
|
you are responsible for ensuring the directory exists with appropriate ownership
|
||||||
|
and permissions.
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
disco_items = mkOption {
|
disco_items = mkOption {
|
||||||
|
@ -524,13 +529,29 @@ in
|
||||||
user = mkOption {
|
user = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "prosody";
|
default = "prosody";
|
||||||
description = "User account under which prosody runs.";
|
description = ''
|
||||||
|
User account under which prosody runs.
|
||||||
|
|
||||||
|
<note><para>
|
||||||
|
If left as the default value this user will automatically be created
|
||||||
|
on system activation, otherwise you are responsible for
|
||||||
|
ensuring the user exists before the prosody service starts.
|
||||||
|
</para></note>
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
group = mkOption {
|
group = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "prosody";
|
default = "prosody";
|
||||||
description = "Group account under which prosody runs.";
|
description = ''
|
||||||
|
Group account under which prosody runs.
|
||||||
|
|
||||||
|
<note><para>
|
||||||
|
If left as the default value this group will automatically be created
|
||||||
|
on system activation, otherwise you are responsible for
|
||||||
|
ensuring the group exists before the prosody service starts.
|
||||||
|
</para></note>
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
allowRegistration = mkOption {
|
allowRegistration = mkOption {
|
||||||
|
@ -839,9 +860,8 @@ in
|
||||||
users.users.prosody = mkIf (cfg.user == "prosody") {
|
users.users.prosody = mkIf (cfg.user == "prosody") {
|
||||||
uid = config.ids.uids.prosody;
|
uid = config.ids.uids.prosody;
|
||||||
description = "Prosody user";
|
description = "Prosody user";
|
||||||
createHome = true;
|
|
||||||
inherit (cfg) group;
|
inherit (cfg) group;
|
||||||
home = "${cfg.dataDir}";
|
home = cfg.dataDir;
|
||||||
};
|
};
|
||||||
|
|
||||||
users.groups.prosody = mkIf (cfg.group == "prosody") {
|
users.groups.prosody = mkIf (cfg.group == "prosody") {
|
||||||
|
@ -854,28 +874,33 @@ in
|
||||||
wants = [ "network-online.target" ];
|
wants = [ "network-online.target" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
restartTriggers = [ config.environment.etc."prosody/prosody.cfg.lua".source ];
|
restartTriggers = [ config.environment.etc."prosody/prosody.cfg.lua".source ];
|
||||||
serviceConfig = {
|
serviceConfig = mkMerge [
|
||||||
User = cfg.user;
|
{
|
||||||
Group = cfg.group;
|
User = cfg.user;
|
||||||
Type = "forking";
|
Group = cfg.group;
|
||||||
RuntimeDirectory = [ "prosody" ];
|
Type = "forking";
|
||||||
PIDFile = "/run/prosody/prosody.pid";
|
RuntimeDirectory = [ "prosody" ];
|
||||||
ExecStart = "${cfg.package}/bin/prosodyctl start";
|
PIDFile = "/run/prosody/prosody.pid";
|
||||||
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
ExecStart = "${cfg.package}/bin/prosodyctl start";
|
||||||
|
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
||||||
|
|
||||||
MemoryDenyWriteExecute = true;
|
MemoryDenyWriteExecute = true;
|
||||||
PrivateDevices = true;
|
PrivateDevices = true;
|
||||||
PrivateMounts = true;
|
PrivateMounts = true;
|
||||||
PrivateTmp = true;
|
PrivateTmp = true;
|
||||||
ProtectControlGroups = true;
|
ProtectControlGroups = true;
|
||||||
ProtectHome = true;
|
ProtectHome = true;
|
||||||
ProtectHostname = true;
|
ProtectHostname = true;
|
||||||
ProtectKernelModules = true;
|
ProtectKernelModules = true;
|
||||||
ProtectKernelTunables = true;
|
ProtectKernelTunables = true;
|
||||||
RestrictNamespaces = true;
|
RestrictNamespaces = true;
|
||||||
RestrictRealtime = true;
|
RestrictRealtime = true;
|
||||||
RestrictSUIDSGID = true;
|
RestrictSUIDSGID = true;
|
||||||
};
|
}
|
||||||
|
(mkIf (cfg.dataDir == "/var/lib/prosody") {
|
||||||
|
StateDirectory = "prosody";
|
||||||
|
})
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
Loading…
Reference in a new issue