mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-06-11 04:05:40 +03:00
1a4575f9db
Previously some modules used `config.environment.etc."ssl/certs/ca-certificates.crt".source`, some used `"/etc/ssl/certs/ca-certificates.crt"`, and some used `"${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"`. These were all bad in one way or another:
- `config.environment.etc."ssl/certs/ca-certificates.crt".source` relies on `source` being set; if `text` is set instead this breaks, introducing a weird undocumented requirement
- `"/etc/ssl/certs/ca-certificates.crt"` is probably okay but very un-nix. It's a magic string, and the path doesn't change when the file changes (and so you can't trigger service reloads, for example, when the contents change in a new system activation)
- `"${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"` silently doesn't include the options from `security.pki`
Co-authored-by: Shelvacu <git@shelvacu.com>
91 lines
2.5 KiB
Nix
91 lines
2.5 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.uptime-kuma;
|
|
in
|
|
{
|
|
|
|
meta.maintainers = [ lib.maintainers.julienmalka ];
|
|
|
|
options = {
|
|
services.uptime-kuma = {
|
|
enable = lib.mkEnableOption "Uptime Kuma, this assumes a reverse proxy to be set";
|
|
|
|
package = lib.mkPackageOption pkgs "uptime-kuma" { };
|
|
|
|
appriseSupport = lib.mkEnableOption "apprise support for notifications";
|
|
|
|
settings = lib.mkOption {
|
|
type = lib.types.submodule { freeformType = with lib.types; attrsOf str; };
|
|
default = { };
|
|
example = {
|
|
PORT = "4000";
|
|
NODE_EXTRA_CA_CERTS = lib.literalExpression "config.security.pki.caBundle";
|
|
};
|
|
description = ''
|
|
Additional configuration for Uptime Kuma, see
|
|
<https://github.com/louislam/uptime-kuma/wiki/Environment-Variables>
|
|
for supported values.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
services.uptime-kuma.settings = {
|
|
DATA_DIR = "/var/lib/uptime-kuma/";
|
|
NODE_ENV = lib.mkDefault "production";
|
|
HOST = lib.mkDefault "127.0.0.1";
|
|
PORT = lib.mkDefault "3001";
|
|
};
|
|
|
|
systemd.services.uptime-kuma = {
|
|
description = "Uptime Kuma";
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
environment = cfg.settings;
|
|
path = with pkgs; [ unixtools.ping ] ++ lib.optional cfg.appriseSupport apprise;
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
StateDirectory = "uptime-kuma";
|
|
DynamicUser = true;
|
|
ExecStart = "${cfg.package}/bin/uptime-kuma-server";
|
|
Restart = "on-failure";
|
|
AmbientCapabilities = "";
|
|
CapabilityBoundingSet = "";
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = false; # enabling it breaks execution
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
PrivateMounts = true;
|
|
PrivateTmp = true;
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "noaccess";
|
|
ProtectSystem = "strict";
|
|
RemoveIPC = true;
|
|
RestrictAddressFamilies = [
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
"AF_UNIX"
|
|
"AF_NETLINK"
|
|
];
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
UMask = 27;
|
|
};
|
|
};
|
|
};
|
|
}
|