Merge pull request #288687 from nu-nu-ko/nixos-navidrome-cleanup
nixos/navidrome: add user/group options, ensure dirs exist/are valid & format changes
This commit is contained in:
éclairevoyant
GitHub
commit
064fe27cf1
3 changed files with 108 additions and 57 deletions
|
|
@ -1,11 +1,17 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (lib) mkEnableOption mkPackageOption mkOption maintainers;
|
||||
inherit (lib.types) bool str;
|
||||
cfg = config.services.navidrome;
|
||||
settingsFormat = pkgs.formats.json {};
|
||||
in {
|
||||
settingsFormat = pkgs.formats.json { };
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.navidrome = {
|
||||
|
||||
|
|
@ -13,9 +19,8 @@ in {
|
|||
|
||||
package = mkPackageOption pkgs "navidrome" { };
|
||||
|
||||
settings = mkOption rec {
|
||||
settings = mkOption {
|
||||
type = settingsFormat.type;
|
||||
apply = recursiveUpdate default;
|
||||
default = {
|
||||
Address = "127.0.0.1";
|
||||
Port = 4533;
|
||||
|
|
@ -23,62 +28,111 @@ in {
|
|||
example = {
|
||||
MusicFolder = "/mnt/music";
|
||||
};
|
||||
description = ''
|
||||
Configuration for Navidrome, see <https://www.navidrome.org/docs/usage/configuration-options/> for supported values.
|
||||
'';
|
||||
description = "Configuration for Navidrome, see <https://www.navidrome.org/docs/usage/configuration-options/> for supported values.";
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = str;
|
||||
default = "navidrome";
|
||||
description = "User under which Navidrome runs.";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = str;
|
||||
default = "navidrome";
|
||||
description = "Group under which Navidrome runs.";
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
type = bool;
|
||||
default = false;
|
||||
description = "Whether to open the TCP port in the firewall";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [cfg.settings.Port];
|
||||
|
||||
systemd.services.navidrome = {
|
||||
description = "Navidrome Media Server";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${cfg.package}/bin/navidrome --configfile ${settingsFormat.generate "navidrome.json" cfg.settings}
|
||||
'';
|
||||
DynamicUser = true;
|
||||
StateDirectory = "navidrome";
|
||||
WorkingDirectory = "/var/lib/navidrome";
|
||||
RuntimeDirectory = "navidrome";
|
||||
RootDirectory = "/run/navidrome";
|
||||
ReadWritePaths = "";
|
||||
BindPaths = lib.optional (cfg.settings ? DataFolder) cfg.settings.DataFolder;
|
||||
BindReadOnlyPaths = [
|
||||
# navidrome uses online services to download additional album metadata / covers
|
||||
"${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
] ++ lib.optional (cfg.settings ? MusicFolder) cfg.settings.MusicFolder;
|
||||
CapabilityBoundingSet = "";
|
||||
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
||||
RestrictNamespaces = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [ "@system-service" "~@privileged" ];
|
||||
RestrictRealtime = true;
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
UMask = "0066";
|
||||
ProtectHostname = true;
|
||||
config =
|
||||
let
|
||||
inherit (lib) mkIf optional getExe;
|
||||
WorkingDirectory = "/var/lib/navidrome";
|
||||
in
|
||||
mkIf cfg.enable {
|
||||
systemd = {
|
||||
tmpfiles.settings.navidromeDirs = {
|
||||
"${cfg.settings.DataFolder or WorkingDirectory}"."d" = {
|
||||
mode = "700";
|
||||
inherit (cfg) user group;
|
||||
};
|
||||
"${cfg.settings.CacheFolder or (WorkingDirectory + "/cache")}"."d" = {
|
||||
mode = "700";
|
||||
inherit (cfg) user group;
|
||||
};
|
||||
};
|
||||
services.navidrome = {
|
||||
description = "Navidrome Media Server";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${getExe cfg.package} --configfile ${settingsFormat.generate "navidrome.json" cfg.settings}
|
||||
'';
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
StateDirectory = "navidrome";
|
||||
inherit WorkingDirectory;
|
||||
RuntimeDirectory = "navidrome";
|
||||
RootDirectory = "/run/navidrome";
|
||||
ReadWritePaths = "";
|
||||
BindPaths =
|
||||
optional (cfg.settings ? DataFolder) cfg.settings.DataFolder
|
||||
++ optional (cfg.settings ? CacheFolder) cfg.settings.CacheFolder;
|
||||
BindReadOnlyPaths = [
|
||||
# navidrome uses online services to download additional album metadata / covers
|
||||
"${
|
||||
config.environment.etc."ssl/certs/ca-certificates.crt".source
|
||||
}:/etc/ssl/certs/ca-certificates.crt"
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
] ++ optional (cfg.settings ? MusicFolder) cfg.settings.MusicFolder;
|
||||
CapabilityBoundingSet = "";
|
||||
RestrictAddressFamilies = [
|
||||
"AF_UNIX"
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
RestrictRealtime = true;
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
UMask = "0066";
|
||||
ProtectHostname = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users = mkIf (cfg.user == "navidrome") {
|
||||
navidrome = {
|
||||
inherit (cfg) group;
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
users.groups = mkIf (cfg.group == "navidrome") { navidrome = { }; };
|
||||
|
||||
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.Port ];
|
||||
};
|
||||
};
|
||||
meta.maintainers = with maintainers; [ nu-nu-ko ];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,7 +10,6 @@
|
|||
, ffmpeg-headless
|
||||
, taglib
|
||||
, zlib
|
||||
, makeWrapper
|
||||
, nixosTests
|
||||
, nix-update-script
|
||||
, ffmpegSupport ? true
|
||||
|
|
@ -40954,8 +40954,6 @@ with pkgs;
|
|||
|
||||
gpio-utils = callPackage ../os-specific/linux/kernel/gpio-utils.nix { };
|
||||
|
||||
navidrome = callPackage ../servers/misc/navidrome { };
|
||||
|
||||
zalgo = callPackage ../tools/misc/zalgo { };
|
||||
|
||||
inherit (callPackage ../applications/misc/zettlr { }) zettlr;
|
||||
|
|
|
|||
Loading…
Reference in a new issue