foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-31 04:58:01 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

services/wezterm-mux-server: add user and group option

Browse Source 
The errors are most likely from wezterm-mux-server trying to start a
shell. This could be configured but it is better to treat this service
similarly to SSH servers.
This commit is contained in:
Gabriel Arazas 2023-07-28 08:35:07 +08:00
parent 6dcbb30e4a
commit ac39b4cc58
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
1 changed files with 41 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
modules/nixos/services/wezterm-mux-server.nix
View File

@ -2,10 +2,13 @@
let
cfg = config.services.wezterm-mux-server;
defaultUser = "wezterm";
in
{
options.services.wezterm-mux-server = {
enable = lib.mkEnableOption "Wezterm mux server";
package = lib.mkOption {
type = lib.types.package;
description = ''
@ -14,6 +17,7 @@ in
default = pkgs.wezterm;
defaultText = "pkgs.wezterm";
};
configFile = lib.mkOption {
type = with lib.types; nullOr path;
description = ''
@ -24,9 +28,44 @@ in
defaultText = "null";
example = lib.literalExpression "./wezterm-mux-server.lua";
};
user = lib.mkOption {
type = lib.types.str;
default = defaultUser;
defaultText = defaultUser;
description = ''
User account of the Wezterm mux server. It is recommended to change
this with a dedicated user account intended to be accessed through SSH.
'';
};
group = lib.mkOption {
type = lib.types.str;
default = defaultUser;
defaultText = defaultUser;
description = ''
The group which the Wezterm mux server runs under. It is recommended to
change this with a dedicated user group intended to be accessed through
SSH.
'';
};
};
config = lib.mkIf cfg.enable {
users.users = lib.mkIf (cfg.user == defaultUser) {
"${defaultUser}" = {
description = "Wezterm mux service";
home = "/home/wezterm";
useDefaultShell = true;
group = cfg.group;
isSystemUser = true;
};
};
users.groups = lib.mkIf (cfg.group == defaultUser) {
"${defaultUser}" = { };
};
systemd.services.wezterm-mux-server = {
description = "Wezterm mux server";
after = [ "network.target" ];
@ -35,10 +74,8 @@ in
# Give it some tough love.
serviceConfig = {
# Use a dynamic user.
User = "wezterm";
Group = "wezterm";
DynamicUser = true;
User = cfg.user;
Group = cfg.group;
LockPersonality = true;
NoNewPrivileges = true;
@ -48,7 +85,6 @@ in
ProtectKernelLogs = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectHome = true;
ProtectHostname = true;
ProtectControlGroups = true;
ProtectProc = "invisible";
@ -58,14 +94,6 @@ in
CacheDirectory = "wezterm";
StateDirectory = "wezterm";
# Filtering system calls.
SystemCallFilter = [
"@system-service"
"~@privileged"
];
SystemCallErrorNumber = "EPERM";
SystemCallArchitectures = "native";
# Restricting what capabilities this service has.
CapabilityBoundingSet = [ "" ];
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];