movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-12 12:45:27 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/mysql: use systemd StateDirectory to provision the data directory

Browse source
This commit is contained in:
Aaron Andersen 2021-12-18 20:50:48 -05:00
parent 382e4ba09a
commit c7cac1bdc0
1 changed files with 48 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

88
nixos/modules/services/databases/mysql.nix
View file

@ -68,7 +68,14 @@ in
dataDir = mkOption { dataDir = mkOption {
type = types.path; type = types.path;
example = "/var/lib/mysql"; example = "/var/lib/mysql";
description = "Location where MySQL stores its table files."; description = ''
The data directory for MySQL.
<note><para>
If left as the default value of <literal>/var/lib/mysql</literal> this directory will automatically be created before the MySQL
server starts, otherwise you are responsible for ensuring the directory exists with appropriate ownership and permissions.
</para></note>
'';
}; };
configFile = mkOption { configFile = mkOption {
@ -341,11 +348,6 @@ in
environment.etc."my.cnf".source = cfg.configFile; environment.etc."my.cnf".source = cfg.configFile;
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
"z '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
];
systemd.services.mysql = let systemd.services.mysql = let
hasNotify = isMariaDB; hasNotify = isMariaDB;
in { in {
@ -489,41 +491,47 @@ in
'') cfg.ensureUsers} '') cfg.ensureUsers}
''; '';
serviceConfig = { serviceConfig = mkMerge [
Type = if hasNotify then "notify" else "simple"; {
Restart = "on-abort"; Type = if hasNotify then "notify" else "simple";
RestartSec = "5s"; Restart = "on-abort";
RestartSec = "5s";
# User and group # User and group
User = cfg.user; User = cfg.user;
Group = cfg.group; Group = cfg.group;
# Runtime directory and mode # Runtime directory and mode
RuntimeDirectory = "mysqld"; RuntimeDirectory = "mysqld";
RuntimeDirectoryMode = "0755"; RuntimeDirectoryMode = "0755";
# Access write directories # Access write directories
ReadWritePaths = [ cfg.dataDir ]; ReadWritePaths = [ cfg.dataDir ];
# Capabilities # Capabilities
CapabilityBoundingSet = ""; CapabilityBoundingSet = "";
# Security # Security
NoNewPrivileges = true; NoNewPrivileges = true;
# Sandboxing # Sandboxing
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = true; ProtectHome = true;
PrivateTmp = true; PrivateTmp = true;
PrivateDevices = true; PrivateDevices = true;
ProtectHostname = true; ProtectHostname = true;
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectControlGroups = true; ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
LockPersonality = true; LockPersonality = true;
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
PrivateMounts = true; PrivateMounts = true;
# System Call Filtering # System Call Filtering
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
}; }
(mkIf (cfg.dataDir == "/var/lib/mysql") {
StateDirectory = "mysql";
StateDirectoryMode = "0700";
})
];
}; };
}; };