nixos/ntopng: update user and redis configuration
New ntopng version supports running as specified user. Create a separate user for ntopng with a separate Redis instance. Separate instance is only used for new `system.stateVersion`s to avoid breaking existing setups. To configure that we add two new options, `redis.address` and `redis.createInstance`. They can also be used to specify your own Redis address.
This commit is contained in:
parent
6a91c56637
commit
41f4d999ad
|
@ -318,6 +318,15 @@
|
|||
<literal>virtualisation.docker.daemon.settings</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Ntopng (<literal>services.ntopng</literal>) is updated to
|
||||
5.2.1 and uses a separate Redis instance if
|
||||
<literal>system.stateVersion</literal> is at least
|
||||
<literal>22.05</literal>. Existing setups shouldn’t be
|
||||
affected.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The backward compatibility in
|
||||
|
|
|
@ -104,6 +104,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
|
||||
- If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.
|
||||
|
||||
- Ntopng (`services.ntopng`) is updated to 5.2.1 and uses a separate Redis instance if `system.stateVersion` is at least `22.05`. Existing setups shouldn't be affected.
|
||||
|
||||
- The backward compatibility in `services.wordpress` to configure sites with
|
||||
the old interface has been removed. Please use `services.wordpress.sites`
|
||||
instead.
|
||||
|
|
|
@ -6,7 +6,13 @@ let
|
|||
|
||||
cfg = config.services.ntopng;
|
||||
opt = options.services.ntopng;
|
||||
redisCfg = config.services.redis;
|
||||
|
||||
createRedis = cfg.redis.createInstance != null;
|
||||
redisService =
|
||||
if cfg.redis.createInstance == "" then
|
||||
"redis.service"
|
||||
else
|
||||
"redis-${cfg.redis.createInstance}.service";
|
||||
|
||||
configFile = if cfg.configText != "" then
|
||||
pkgs.writeText "ntopng.conf" ''
|
||||
|
@ -16,7 +22,9 @@ let
|
|||
pkgs.writeText "ntopng.conf" ''
|
||||
${concatStringsSep " " (map (e: "--interface=" + e) cfg.interfaces)}
|
||||
--http-port=${toString cfg.http-port}
|
||||
--redis=localhost:${toString redisCfg.port}
|
||||
--redis=${cfg.redis.address}
|
||||
--data-dir=/var/lib/ntopng
|
||||
--user=ntopng
|
||||
${cfg.extraConfig}
|
||||
'';
|
||||
|
||||
|
@ -64,6 +72,24 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
redis.address = mkOption {
|
||||
type = types.str;
|
||||
example = literalExpression "config.services.redis.ntopng.unixSocket";
|
||||
description = ''
|
||||
Redis address - may be a Unix socket or a network host and port.
|
||||
'';
|
||||
};
|
||||
|
||||
redis.createInstance = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = if versionAtLeast config.system.stateVersion "22.05" then "ntopng" else "";
|
||||
description = ''
|
||||
Local Redis instance name. Set to <literal>null</literal> to disable
|
||||
local Redis instance. Defaults to <literal>""</literal> for
|
||||
<literal>system.stateVersion</literal> older than 22.05.
|
||||
'';
|
||||
};
|
||||
|
||||
configText = mkOption {
|
||||
default = "";
|
||||
example = ''
|
||||
|
@ -95,23 +121,36 @@ in
|
|||
config = mkIf cfg.enable {
|
||||
|
||||
# ntopng uses redis for data storage
|
||||
services.redis.enable = true;
|
||||
services.ntopng.redis.address =
|
||||
mkIf createRedis config.services.redis.servers.${cfg.redis.createInstance}.unixSocket;
|
||||
|
||||
services.redis.servers = mkIf createRedis {
|
||||
${cfg.redis.createInstance} = {
|
||||
enable = true;
|
||||
user = mkIf (cfg.redis.createInstance == "ntopng") "ntopng";
|
||||
};
|
||||
};
|
||||
|
||||
# nice to have manual page and ntopng command in PATH
|
||||
environment.systemPackages = [ pkgs.ntopng ];
|
||||
|
||||
systemd.tmpfiles.rules = [ "d /var/lib/ntopng 0700 ntopng ntopng -" ];
|
||||
|
||||
systemd.services.ntopng = {
|
||||
description = "Ntopng Network Monitor";
|
||||
requires = [ "redis.service" ];
|
||||
after = [ "network.target" "redis.service" ];
|
||||
requires = optional createRedis redisService;
|
||||
after = [ "network.target" ] ++ optional createRedis redisService;
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
preStart = "mkdir -p /var/lib/ntopng/";
|
||||
serviceConfig.ExecStart = "${pkgs.ntopng}/bin/ntopng ${configFile}";
|
||||
unitConfig.Documentation = "man:ntopng(8)";
|
||||
};
|
||||
|
||||
# ntopng drops priveleges to user "nobody" and that user is already defined
|
||||
# in users-groups.nix.
|
||||
users.extraUsers.ntopng = {
|
||||
group = "ntopng";
|
||||
isSystemUser = true;
|
||||
};
|
||||
|
||||
users.extraGroups.ntopng = { };
|
||||
};
|
||||
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue