zuckerberg/picture-frame
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve nixos service so it uses a dynamic user

Browse Source
This commit is contained in:
Zuckerberg 2023-12-02 10:22:12 -07:00
parent a0bfd2bcca
commit 2a51a33f9b
1 changed files with 14 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
server/service.nix
View File

@ -7,26 +7,19 @@ in
{
options.services.picture-frame-server = {
enable = lib.mkEnableOption "enable picture-frame-server";
user = lib.mkOption {
type = lib.types.str;
default = "picture-frame-server";
description = ''
The user the server should run as
'';
};
group = lib.mkOption {
type = lib.types.str;
default = "picture-frame-server";
description = ''
The group the server should run as
'';
};
imgDir = lib.mkOption {
type = lib.types.str;
description = ''
Directory of images that the server will serve
'';
};
imgDirGroup = lib.mkOption {
type = lib.types.str;
description = ''
The group the server will run as a member of.
So the server can have read access to `imgDir`.
'';
};
port = lib.mkOption {
type = lib.types.int;
default = 18450;
@ -38,18 +31,17 @@ in
config = lib.mkIf cfg.enable {
nixpkgs.overlays = [ overlay ];
users.users.${cfg.user} = {
isSystemUser = true;
group = cfg.group;
};
users.groups.${cfg.group} = { };
systemd.services.picture-frame-server = {
enable = true;
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.ExecStart = "${pkgs.picture-frame.server}/bin/server ${toString cfg.port} ${cfg.imgDir}";
serviceConfig.User = cfg.user;
serviceConfig.Group = cfg.group;
serviceConfig = {
ExecStart = "${pkgs.picture-frame.server}/bin/server ${toString cfg.port} ${cfg.imgDir}";
DynamicUser = true;
PrivateTmp = true;
User = "picture-frame-server";
SupplementaryGroups = [ cfg.imgDirGroup ];
};
};
};
}