Revert "nixos/ntfy-sh: add defaults, use dynamic user"
This reverts commit 3dcca62a5e
.
This commit is contained in:
parent
725b45946e
commit
9631553153
|
@ -19,6 +19,18 @@ in
|
||||||
description = mdDoc "The ntfy.sh package to use.";
|
description = mdDoc "The ntfy.sh package to use.";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
user = mkOption {
|
||||||
|
default = "ntfy-sh";
|
||||||
|
type = types.str;
|
||||||
|
description = lib.mdDoc "User the ntfy-sh server runs under.";
|
||||||
|
};
|
||||||
|
|
||||||
|
group = mkOption {
|
||||||
|
default = "ntfy-sh";
|
||||||
|
type = types.str;
|
||||||
|
description = lib.mdDoc "Primary group of ntfy-sh user.";
|
||||||
|
};
|
||||||
|
|
||||||
settings = mkOption {
|
settings = mkOption {
|
||||||
type = types.submodule { freeformType = settingsFormat.type; };
|
type = types.submodule { freeformType = settingsFormat.type; };
|
||||||
|
|
||||||
|
@ -49,9 +61,6 @@ in
|
||||||
|
|
||||||
services.ntfy-sh.settings = {
|
services.ntfy-sh.settings = {
|
||||||
auth-file = mkDefault "/var/lib/ntfy-sh/user.db";
|
auth-file = mkDefault "/var/lib/ntfy-sh/user.db";
|
||||||
listen-http = mkDefault "127.0.0.1:2586";
|
|
||||||
attachment-cache-dir = mkDefault "/var/lib/ntfy-sh/attachments";
|
|
||||||
cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.ntfy-sh = {
|
systemd.services.ntfy-sh = {
|
||||||
|
@ -61,15 +70,10 @@ in
|
||||||
after = [ "network.target" ];
|
after = [ "network.target" ];
|
||||||
|
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStartPre = [
|
|
||||||
"${pkgs.coreutils}/bin/touch ${cfg.settings.auth-file}"
|
|
||||||
"${pkgs.coreutils}/bin/mkdir -p ${cfg.settings.attachment-cache-dir}"
|
|
||||||
"${pkgs.coreutils}/bin/touch ${cfg.settings.cache-file}"
|
|
||||||
];
|
|
||||||
ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";
|
ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";
|
||||||
|
User = cfg.user;
|
||||||
StateDirectory = "ntfy-sh";
|
StateDirectory = "ntfy-sh";
|
||||||
|
|
||||||
DynamicUser = true;
|
|
||||||
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
|
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
|
||||||
PrivateTmp = true;
|
PrivateTmp = true;
|
||||||
NoNewPrivileges = true;
|
NoNewPrivileges = true;
|
||||||
|
@ -84,8 +88,17 @@ in
|
||||||
RestrictNamespaces = true;
|
RestrictNamespaces = true;
|
||||||
RestrictRealtime = true;
|
RestrictRealtime = true;
|
||||||
MemoryDenyWriteExecute = true;
|
MemoryDenyWriteExecute = true;
|
||||||
# Upstream Requirements
|
};
|
||||||
LimitNOFILE = 20500;
|
};
|
||||||
|
|
||||||
|
users.groups = optionalAttrs (cfg.group == "ntfy-sh") {
|
||||||
|
ntfy-sh = { };
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users = optionalAttrs (cfg.user == "ntfy-sh") {
|
||||||
|
ntfy-sh = {
|
||||||
|
isSystemUser = true;
|
||||||
|
group = cfg.group;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -19,7 +19,5 @@ import ./make-test-python.nix {
|
||||||
notif = json.loads(machine.succeed("curl -s localhost:80/test/json?poll=1"))
|
notif = json.loads(machine.succeed("curl -s localhost:80/test/json?poll=1"))
|
||||||
|
|
||||||
assert msg == notif["message"], "Wrong message"
|
assert msg == notif["message"], "Wrong message"
|
||||||
|
|
||||||
machine.succeed("ntfy user list")
|
|
||||||
'';
|
'';
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue