nixos/prosody: conditionally provision required directories with StateDirectory
This commit is contained in:
parent
fdb531e995
commit
79bfd3c0d0
|
@ -511,8 +511,13 @@ in
|
||||||
|
|
||||||
dataDir = mkOption {
|
dataDir = mkOption {
|
||||||
type = types.path;
|
type = types.path;
|
||||||
description = "Directory where Prosody stores its data";
|
|
||||||
default = "/var/lib/prosody";
|
default = "/var/lib/prosody";
|
||||||
|
description = ''
|
||||||
|
The prosody home directory used to store all data. If left as the default value
|
||||||
|
this directory will automatically be created before the prosody server starts, otherwise
|
||||||
|
you are responsible for ensuring the directory exists with appropriate ownership
|
||||||
|
and permissions.
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
disco_items = mkOption {
|
disco_items = mkOption {
|
||||||
|
@ -839,9 +844,8 @@ in
|
||||||
users.users.prosody = mkIf (cfg.user == "prosody") {
|
users.users.prosody = mkIf (cfg.user == "prosody") {
|
||||||
uid = config.ids.uids.prosody;
|
uid = config.ids.uids.prosody;
|
||||||
description = "Prosody user";
|
description = "Prosody user";
|
||||||
createHome = true;
|
|
||||||
inherit (cfg) group;
|
inherit (cfg) group;
|
||||||
home = "${cfg.dataDir}";
|
home = cfg.dataDir;
|
||||||
};
|
};
|
||||||
|
|
||||||
users.groups.prosody = mkIf (cfg.group == "prosody") {
|
users.groups.prosody = mkIf (cfg.group == "prosody") {
|
||||||
|
@ -854,28 +858,33 @@ in
|
||||||
wants = [ "network-online.target" ];
|
wants = [ "network-online.target" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
restartTriggers = [ config.environment.etc."prosody/prosody.cfg.lua".source ];
|
restartTriggers = [ config.environment.etc."prosody/prosody.cfg.lua".source ];
|
||||||
serviceConfig = {
|
serviceConfig = mkMerge [
|
||||||
User = cfg.user;
|
{
|
||||||
Group = cfg.group;
|
User = cfg.user;
|
||||||
Type = "forking";
|
Group = cfg.group;
|
||||||
RuntimeDirectory = [ "prosody" ];
|
Type = "forking";
|
||||||
PIDFile = "/run/prosody/prosody.pid";
|
RuntimeDirectory = [ "prosody" ];
|
||||||
ExecStart = "${cfg.package}/bin/prosodyctl start";
|
PIDFile = "/run/prosody/prosody.pid";
|
||||||
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
ExecStart = "${cfg.package}/bin/prosodyctl start";
|
||||||
|
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
||||||
|
|
||||||
MemoryDenyWriteExecute = true;
|
MemoryDenyWriteExecute = true;
|
||||||
PrivateDevices = true;
|
PrivateDevices = true;
|
||||||
PrivateMounts = true;
|
PrivateMounts = true;
|
||||||
PrivateTmp = true;
|
PrivateTmp = true;
|
||||||
ProtectControlGroups = true;
|
ProtectControlGroups = true;
|
||||||
ProtectHome = true;
|
ProtectHome = true;
|
||||||
ProtectHostname = true;
|
ProtectHostname = true;
|
||||||
ProtectKernelModules = true;
|
ProtectKernelModules = true;
|
||||||
ProtectKernelTunables = true;
|
ProtectKernelTunables = true;
|
||||||
RestrictNamespaces = true;
|
RestrictNamespaces = true;
|
||||||
RestrictRealtime = true;
|
RestrictRealtime = true;
|
||||||
RestrictSUIDSGID = true;
|
RestrictSUIDSGID = true;
|
||||||
};
|
}
|
||||||
|
(mkIf (cfg.dataDir == "/var/lib/prosody") {
|
||||||
|
StateDirectory = "prosody";
|
||||||
|
})
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
Loading…
Reference in a new issue