mirror of
https://github.com/ilyakooo0/nixpkgs.git
synced 2024-11-10 08:39:08 +03:00
Merge pull request #267983 from nikstur/replace-simple-activation-2
nixos: replace activationScripts 2/x
This commit is contained in:
nikstur
GitHub
commit
5a9c0b7600
@ -226,18 +226,6 @@ in
|
||||
"ldap.conf" = ldapConfig;
|
||||
};
|
||||
|
||||
system.activationScripts = mkIf (!cfg.daemon.enable) {
|
||||
ldap = stringAfter [ "etc" "groups" "users" ] ''
|
||||
if test -f "${cfg.bind.passwordFile}" ; then
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
|
||||
cat ${ldapConfig.source} - >"$conf"
|
||||
mv -fT "$conf" /etc/ldap.conf
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
system.nssModules = mkIf cfg.nsswitch (singleton (
|
||||
if cfg.daemon.enable then nss_pam_ldapd else nss_ldap
|
||||
));
|
||||
@ -258,42 +246,63 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services = mkIf cfg.daemon.enable {
|
||||
nslcd = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
preStart = ''
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
{
|
||||
cat ${nslcdConfig}
|
||||
test -z '${cfg.bind.distinguishedName}' -o ! -f '${cfg.bind.passwordFile}' ||
|
||||
printf 'bindpw %s\n' "$(cat '${cfg.bind.passwordFile}')"
|
||||
test -z '${cfg.daemon.rootpwmoddn}' -o ! -f '${cfg.daemon.rootpwmodpwFile}' ||
|
||||
printf 'rootpwmodpw %s\n' "$(cat '${cfg.daemon.rootpwmodpwFile}')"
|
||||
} >"$conf"
|
||||
mv -fT "$conf" /run/nslcd/nslcd.conf
|
||||
'';
|
||||
|
||||
restartTriggers = [
|
||||
nslcdConfig
|
||||
cfg.bind.passwordFile
|
||||
cfg.daemon.rootpwmodpwFile
|
||||
];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${nslcdWrapped}/bin/nslcd";
|
||||
Type = "forking";
|
||||
Restart = "always";
|
||||
User = "nslcd";
|
||||
Group = "nslcd";
|
||||
RuntimeDirectory = [ "nslcd" ];
|
||||
PIDFile = "/run/nslcd/nslcd.pid";
|
||||
AmbientCapabilities = "CAP_SYS_RESOURCE";
|
||||
systemd.services = mkMerge [
|
||||
(mkIf (!cfg.daemon.enable) {
|
||||
ldap-password = {
|
||||
wantedBy = [ "sysinit.target" ];
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
if test -f "${cfg.bind.passwordFile}" ; then
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
|
||||
cat ${ldapConfig.source} - >"$conf"
|
||||
mv -fT "$conf" /etc/ldap.conf
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
};
|
||||
(mkIf cfg.daemon.enable {
|
||||
nslcd = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
preStart = ''
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
{
|
||||
cat ${nslcdConfig}
|
||||
test -z '${cfg.bind.distinguishedName}' -o ! -f '${cfg.bind.passwordFile}' ||
|
||||
printf 'bindpw %s\n' "$(cat '${cfg.bind.passwordFile}')"
|
||||
test -z '${cfg.daemon.rootpwmoddn}' -o ! -f '${cfg.daemon.rootpwmodpwFile}' ||
|
||||
printf 'rootpwmodpw %s\n' "$(cat '${cfg.daemon.rootpwmodpwFile}')"
|
||||
} >"$conf"
|
||||
mv -fT "$conf" /run/nslcd/nslcd.conf
|
||||
'';
|
||||
|
||||
restartTriggers = [
|
||||
nslcdConfig
|
||||
cfg.bind.passwordFile
|
||||
cfg.daemon.rootpwmodpwFile
|
||||
];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${nslcdWrapped}/bin/nslcd";
|
||||
Type = "forking";
|
||||
Restart = "always";
|
||||
User = "nslcd";
|
||||
Group = "nslcd";
|
||||
RuntimeDirectory = [ "nslcd" ];
|
||||
PIDFile = "/run/nslcd/nslcd.pid";
|
||||
AmbientCapabilities = "CAP_SYS_RESOURCE";
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
|
||||
@ -12,7 +12,6 @@ let
|
||||
mkDefault
|
||||
mkIf
|
||||
mkOption
|
||||
stringAfter
|
||||
types
|
||||
;
|
||||
|
||||
|
||||
@ -39,9 +39,10 @@ in
|
||||
|
||||
hardware.firmware = [ package.fw ];
|
||||
|
||||
system.activationScripts.setup-amdgpu-pro = ''
|
||||
ln -sfn ${package}/opt/amdgpu{,-pro} /run
|
||||
'';
|
||||
systemd.tmpfiles.settings.amdgpu-pro = {
|
||||
"/run/amdgpu"."L+".argument = "${package}/opt/amdgpu";
|
||||
"/run/amdgpu-pro"."L+".argument = "${package}/opt/amdgpu-pro";
|
||||
};
|
||||
|
||||
system.requiredKernelConfig = with config.lib.kernelConfig; [
|
||||
(isYes "DEVICE_PRIVATE")
|
||||
|
||||
@ -181,25 +181,33 @@ in {
|
||||
'';
|
||||
};
|
||||
|
||||
system.activationScripts.ipa = stringAfter ["etc"] ''
|
||||
# libcurl requires a hard copy of the certificate
|
||||
if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
|
||||
rm -f /etc/ipa/ca.crt
|
||||
cp ${cfg.certificate} /etc/ipa/ca.crt
|
||||
fi
|
||||
systemd.services."ipa-activation" = {
|
||||
wantedBy = [ "sysinit.target" ];
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
# libcurl requires a hard copy of the certificate
|
||||
if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
|
||||
rm -f /etc/ipa/ca.crt
|
||||
cp ${cfg.certificate} /etc/ipa/ca.crt
|
||||
fi
|
||||
|
||||
if [ ! -f /etc/krb5.keytab ]; then
|
||||
cat <<EOF
|
||||
if [ ! -f /etc/krb5.keytab ]; then
|
||||
cat <<EOF
|
||||
|
||||
In order to complete FreeIPA integration, please join the domain by completing the following steps:
|
||||
1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
|
||||
2. Join the domain and obtain the keytab file: ipa-join
|
||||
3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
|
||||
4. Restart sssd systemd service: sudo systemctl restart sssd
|
||||
In order to complete FreeIPA integration, please join the domain by completing the following steps:
|
||||
1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
|
||||
2. Join the domain and obtain the keytab file: ipa-join
|
||||
3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
|
||||
4. Restart sssd systemd service: sudo systemctl restart sssd
|
||||
|
||||
EOF
|
||||
fi
|
||||
'';
|
||||
EOF
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
services.sssd.config = ''
|
||||
[domain/${cfg.domain}]
|
||||
|
||||
@ -280,6 +280,7 @@ in
|
||||
wantedBy = [ "sysinit.target" ];
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
after = [ "systemd-sysusers.service" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
unitConfig.RequiresMountsFor = [ "/nix/store" "/run/wrappers" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
||||
@ -143,20 +143,15 @@ let
|
||||
};
|
||||
|
||||
# Paths listed in ReadWritePaths must exist before service is started
|
||||
mkActivationScript = name: cfg:
|
||||
mkTmpfiles = name: cfg:
|
||||
let
|
||||
install = "install -o ${cfg.user} -g ${cfg.group}";
|
||||
in
|
||||
nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''
|
||||
# Ensure that the home directory already exists
|
||||
# We can't assert createHome == true because that's not the case for root
|
||||
cd "${config.users.users.${cfg.user}.home}"
|
||||
# Create each directory separately to prevent root owned parent dirs
|
||||
${install} -d .config .config/borg
|
||||
${install} -d .cache .cache/borg
|
||||
'' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''
|
||||
${install} -d ${escapeShellArg cfg.repo}
|
||||
''));
|
||||
settings = { inherit (cfg) user group; };
|
||||
in lib.nameValuePair "borgbackup-job-${name}" ({
|
||||
"${config.users.users."${cfg.user}".home}/.config/borg".d = settings;
|
||||
"${config.users.users."${cfg.user}".home}/.cache/borg".d = settings;
|
||||
} // optionalAttrs (isLocalPath cfg.repo && !cfg.removableDevice) {
|
||||
"${cfg.repo}".d = settings;
|
||||
});
|
||||
|
||||
mkPassAssertion = name: cfg: {
|
||||
assertion = with cfg.encryption;
|
||||
@ -760,7 +755,7 @@ in {
|
||||
++ mapAttrsToList mkSourceAssertions jobs
|
||||
++ mapAttrsToList mkRemovableDeviceAssertions jobs;
|
||||
|
||||
system.activationScripts = mapAttrs' mkActivationScript jobs;
|
||||
systemd.tmpfiles.settings = mapAttrs' mkTmpfiles jobs;
|
||||
|
||||
systemd.services =
|
||||
# A job named "foo" is mapped to systemd.services.borgbackup-job-foo
|
||||
|
||||
@ -220,10 +220,16 @@ in
|
||||
logcheck = {};
|
||||
};
|
||||
|
||||
system.activationScripts.logcheck = ''
|
||||
mkdir -m 700 -p /var/{lib,lock}/logcheck
|
||||
chown ${cfg.user} /var/{lib,lock}/logcheck
|
||||
'';
|
||||
systemd.tmpfiles.settings.logcheck = {
|
||||
"/var/lib/logcheck".d = {
|
||||
mode = "700";
|
||||
inherit (cfg) user;
|
||||
};
|
||||
"/var/lock/logcheck".d = {
|
||||
mode = "700";
|
||||
inherit (cfg) user;
|
||||
};
|
||||
};
|
||||
|
||||
services.cron.systemCronJobs =
|
||||
let withTime = name: {timeArgs, ...}: timeArgs != null;
|
||||
|
||||
@ -137,16 +137,24 @@ in
|
||||
message = "networking.enableIPv6 must be true for yggdrasil to work";
|
||||
}];
|
||||
|
||||
system.activationScripts.yggdrasil = mkIf cfg.persistentKeys ''
|
||||
if [ ! -e ${keysPath} ]
|
||||
then
|
||||
mkdir --mode=700 -p ${builtins.dirOf keysPath}
|
||||
${binYggdrasil} -genconf -json \
|
||||
| ${pkgs.jq}/bin/jq \
|
||||
'to_entries|map(select(.key|endswith("Key")))|from_entries' \
|
||||
> ${keysPath}
|
||||
fi
|
||||
'';
|
||||
# This needs to be a separate service. The yggdrasil service fails if
|
||||
# this is put into its preStart.
|
||||
systemd.services.yggdrasil-persistent-keys = lib.mkIf cfg.persistentKeys {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [ "yggdrasil.service" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
if [ ! -e ${keysPath} ]
|
||||
then
|
||||
mkdir --mode=700 -p ${builtins.dirOf keysPath}
|
||||
${binYggdrasil} -genconf -json \
|
||||
| ${pkgs.jq}/bin/jq \
|
||||
'to_entries|map(select(.key|endswith("Key")))|from_entries' \
|
||||
> ${keysPath}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.yggdrasil = {
|
||||
description = "Yggdrasil Network Service";
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib) mkOption mkDefault types optionalString stringAfter;
|
||||
inherit (lib) mkOption mkDefault types optionalString;
|
||||
|
||||
cfg = config.boot.binfmt;
|
||||
|
||||
|
||||
@ -80,10 +80,17 @@ with lib;
|
||||
ACTION=="add|change", SUBSYSTEM=="input", ATTR{name}=="${cfg.device}", ATTR{device/speed}="${toString cfg.speed}", ATTR{device/sensitivity}="${toString cfg.sensitivity}"
|
||||
'';
|
||||
|
||||
system.activationScripts.trackpoint =
|
||||
''
|
||||
${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}"
|
||||
systemd.services.trackpoint = {
|
||||
wantedBy = [ "sysinit.target" ] ;
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
serviceConfig.ExecStart = ''
|
||||
${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}
|
||||
'';
|
||||
};
|
||||
})
|
||||
|
||||
(mkIf (cfg.emulateWheel) {
|
||||
|
||||
@ -85,35 +85,44 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
###### wrappers activation script
|
||||
|
||||
system.activationScripts.vmwareWrappers =
|
||||
lib.stringAfter [ "specialfs" "users" ]
|
||||
''
|
||||
mkdir -p "${parentWrapperDir}"
|
||||
chmod 755 "${parentWrapperDir}"
|
||||
# We want to place the tmpdirs for the wrappers to the parent dir.
|
||||
wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
|
||||
chmod a+rx "$wrapperDir"
|
||||
${lib.concatStringsSep "\n" (vmwareWrappers)}
|
||||
if [ -L ${wrapperDir} ]; then
|
||||
# Atomically replace the symlink
|
||||
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
|
||||
old=$(readlink -f ${wrapperDir})
|
||||
if [ -e "${wrapperDir}-tmp" ]; then
|
||||
rm --force --recursive "${wrapperDir}-tmp"
|
||||
fi
|
||||
ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
|
||||
mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
|
||||
rm --force --recursive "$old"
|
||||
else
|
||||
# For initial setup
|
||||
ln --symbolic "$wrapperDir" "${wrapperDir}"
|
||||
fi
|
||||
'';
|
||||
|
||||
# Services
|
||||
|
||||
systemd.services."vmware-wrappers" = {
|
||||
description = "Create VMVare Wrappers";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [
|
||||
"vmware-authdlauncher.service"
|
||||
"vmware-networks-configuration.service"
|
||||
"vmware-networks.service"
|
||||
"vmware-usbarbitrator.service"
|
||||
];
|
||||
after = [ "systemd-sysusers.service" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
mkdir -p "${parentWrapperDir}"
|
||||
chmod 755 "${parentWrapperDir}"
|
||||
# We want to place the tmpdirs for the wrappers to the parent dir.
|
||||
wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
|
||||
chmod a+rx "$wrapperDir"
|
||||
${lib.concatStringsSep "\n" (vmwareWrappers)}
|
||||
if [ -L ${wrapperDir} ]; then
|
||||
# Atomically replace the symlink
|
||||
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
|
||||
old=$(readlink -f ${wrapperDir})
|
||||
if [ -e "${wrapperDir}-tmp" ]; then
|
||||
rm --force --recursive "${wrapperDir}-tmp"
|
||||
fi
|
||||
ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
|
||||
mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
|
||||
rm --force --recursive "$old"
|
||||
else
|
||||
# For initial setup
|
||||
ln --symbolic "$wrapperDir" "${wrapperDir}"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services."vmware-authdlauncher" = {
|
||||
description = "VMware Authentication Daemon";
|
||||
serviceConfig = {
|
||||
|
||||
@ -13,9 +13,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||
'';
|
||||
|
||||
# ensure the directory to be monitored exists before incron is started
|
||||
system.activationScripts.incronTest = ''
|
||||
mkdir /test
|
||||
'';
|
||||
systemd.tmpfiles.settings.incron-test = {
|
||||
"/test".d = { };
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
|
||||
@ -13,10 +13,12 @@ in {
|
||||
# The only thing the client needs to do is download a file.
|
||||
client = { ... }: {
|
||||
services.davfs2.enable = true;
|
||||
system.activationScripts.davfs2-secrets = ''
|
||||
echo "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}" > /tmp/davfs2-secrets
|
||||
chmod 600 /tmp/davfs2-secrets
|
||||
'';
|
||||
systemd.tmpfiles.settings.nextcloud = {
|
||||
"/tmp/davfs2-secrets"."f+" = {
|
||||
mode = "0600";
|
||||
argument = "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}";
|
||||
};
|
||||
};
|
||||
virtualisation.fileSystems = {
|
||||
"/mnt/dav" = {
|
||||
device = "http://nextcloud/remote.php/dav/files/${adminuser}";
|
||||
|
||||
Loading…
Reference in New Issue
Block a user