movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

pinchflat: use a static user

Browse source
This commit is contained in:
charludo 2025-06-09 13:17:49 +02:00
parent 95cca8d853
commit c2450f04fb
No known key found for this signature in database
1 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nixos/modules/services/misc/pinchflat.nix
View file

@ -62,6 +62,22 @@ in
description = "Log level for Pinchflat."; description = "Log level for Pinchflat.";
}; };
user = lib.mkOption {
type = lib.types.str;
default = "pinchflat";
description = ''
User account under which Pinchflat runs.
'';
};
group = lib.mkOption {
type = lib.types.str;
default = "pinchflat";
description = ''
Group under which Pinchflat runs.
'';
};
extraConfig = mkOption { extraConfig = mkOption {
type = type =
with types; with types;
@ -125,7 +141,9 @@ in
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "simple";
DynamicUser = true; User = cfg.user;
Group = cfg.group;
StateDirectory = baseNameOf stateDir; StateDirectory = baseNameOf stateDir;
Environment = Environment =
[ [
@ -151,6 +169,17 @@ in
}; };
}; };
users.users = lib.mkIf (cfg.user == "pinchflat") {
pinchflat = {
group = cfg.group;
isSystemUser = true;
};
};
users.groups = lib.mkIf (cfg.group == "pinchflat") {
pinchflat = { };
};
networking.firewall = mkIf cfg.openFirewall { networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.port ]; allowedTCPPorts = [ cfg.port ];
}; };