momo/erpnext-nix
4
0
Fork 0
forked from axeman/erpnext-nix
Code Pull requests Activity

module: fix DNS by adding resolv.conf, ssl dirs to

Browse source 
BindReadOnlyPaths
This should fix temporary name resolution errors observed in erpnext.

Minor cleanup and explanatory comment for confinement.packages

We don't use pkgs from path, but prefer explicitly referring to pkgs
This commit is contained in:
teutat3s 2023-07-18 12:23:09 +02:00
parent 5519e0d6fe
commit ceb04d96de
Signed by: teutat3s
GPG key ID: 4FA1D3FA524F22C1
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
modules/erpnext.nix
View file

@ -212,6 +212,9 @@ in
Type = "simple";
BindReadOnlyPaths = [
"/etc/hosts:/etc/hosts"
"/etc/resolv.conf:/etc/resolv.conf"
"/etc/ssl:/etc/ssl"
"/etc/static/ssl:/etc/static/ssl"
"/run/agenix:/run/agenix"
"${pkgs.frappe-app}:${pkgs.frappe-app}"
"${pkgs.frappe-app}/share/apps/frappe:${cfg.benchDir}/apps/frappe"
@ -330,12 +333,20 @@ in
description = "ERPNext web server";
confinement = {
enable = true;
packages = [ pkgs.mariadb-client penv ];
# pkgs listed here get added to the services' BindReadOnlyPaths
# The same is true for pkgs referred to in ExecStartPre, ExecStart, etc.
# Explicitily listing these pkgs here for visibility
packages = [
penv
pkgs.coreutils
# Dependency for 'bench new-site' subcommand
pkgs.mariadb-client
pkgs.replace-secret
];
};
environment = {
PYTHON_PATH = "${penv}/${pkgs.python3.sitePackages}";
};
path = [ pkgs.mariadb-client penv pkgs.coreutils ];
serviceConfig = defaultServiceConfig // {
TimeoutStartSec = "300s";
Restart = "on-failure";