foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-02-07 06:19:00 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

services/archivebox: add dedicated service user and group

Browse Source
This commit is contained in:
Gabriel Arazas 2023-11-07 20:53:15 +08:00
parent cee845a94b
commit 8b812a34c9
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
modules/nixos/services/archivebox.nix
View File

@ -58,6 +58,9 @@ let
| archivebox add ${lib.concatStringsSep " " value.extraArgs} | archivebox add ${lib.concatStringsSep " " value.extraArgs}
''; '';
serviceConfig = { serviceConfig = {
User = "archivebox";
Group = "archivebox";
LockPersonality = true; LockPersonality = true;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateTmp = true; PrivateTmp = true;
@ -158,6 +161,12 @@ in
{ {
systemd.services = lib.mapAttrs' mkJobService cfg.jobs; systemd.services = lib.mapAttrs' mkJobService cfg.jobs;
systemd.timers = lib.mapAttrs' mkTimerUnit cfg.jobs; systemd.timers = lib.mapAttrs' mkTimerUnit cfg.jobs;
users.users.archivebox = {
group = config.users.groups.archivebox.name;
isNormalUser = true;
home = "/var/lib/archivebox";
};
} }
(lib.mkIf cfg.webserver.enable { (lib.mkIf cfg.webserver.enable {
@ -167,6 +176,8 @@ in
documentation = [ "https://docs.archivebox.io/" ]; documentation = [ "https://docs.archivebox.io/" ];
wantedBy = [ "graphical-session.target" ]; wantedBy = [ "graphical-session.target" ];
serviceConfig = { serviceConfig = {
User = "archivebox";
Group = "archivebox";
ExecStart = "${pkgs.archivebox}/bin/archivebox server localhost:${ ExecStart = "${pkgs.archivebox}/bin/archivebox server localhost:${
toString cfg.webserver.port toString cfg.webserver.port
}"; }";