Merge pull request #267983 from nikstur/replace-simple-activation-2
nixos: replace activationScripts 2/x
This commit is contained in:
nikstur
GitHub
commit
5a9c0b7600
13 changed files with 177 additions and 132 deletions
|
|
@ -226,18 +226,6 @@ in
|
|||
"ldap.conf" = ldapConfig;
|
||||
};
|
||||
|
||||
system.activationScripts = mkIf (!cfg.daemon.enable) {
|
||||
ldap = stringAfter [ "etc" "groups" "users" ] ''
|
||||
if test -f "${cfg.bind.passwordFile}" ; then
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
|
||||
cat ${ldapConfig.source} - >"$conf"
|
||||
mv -fT "$conf" /etc/ldap.conf
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
system.nssModules = mkIf cfg.nsswitch (singleton (
|
||||
if cfg.daemon.enable then nss_pam_ldapd else nss_ldap
|
||||
));
|
||||
|
|
@ -258,7 +246,28 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
systemd.services = mkIf cfg.daemon.enable {
|
||||
systemd.services = mkMerge [
|
||||
(mkIf (!cfg.daemon.enable) {
|
||||
ldap-password = {
|
||||
wantedBy = [ "sysinit.target" ];
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
if test -f "${cfg.bind.passwordFile}" ; then
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
|
||||
cat ${ldapConfig.source} - >"$conf"
|
||||
mv -fT "$conf" /etc/ldap.conf
|
||||
fi
|
||||
'';
|
||||
};
|
||||
})
|
||||
|
||||
(mkIf cfg.daemon.enable {
|
||||
nslcd = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
|
|
@ -292,8 +301,8 @@ in
|
|||
AmbientCapabilities = "CAP_SYS_RESOURCE";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,6 @@ let
|
|||
mkDefault
|
||||
mkIf
|
||||
mkOption
|
||||
stringAfter
|
||||
types
|
||||
;
|
||||
|
||||
|
|
|
|||
|
|
@ -39,9 +39,10 @@ in
|
|||
|
||||
hardware.firmware = [ package.fw ];
|
||||
|
||||
system.activationScripts.setup-amdgpu-pro = ''
|
||||
ln -sfn ${package}/opt/amdgpu{,-pro} /run
|
||||
'';
|
||||
systemd.tmpfiles.settings.amdgpu-pro = {
|
||||
"/run/amdgpu"."L+".argument = "${package}/opt/amdgpu";
|
||||
"/run/amdgpu-pro"."L+".argument = "${package}/opt/amdgpu-pro";
|
||||
};
|
||||
|
||||
system.requiredKernelConfig = with config.lib.kernelConfig; [
|
||||
(isYes "DEVICE_PRIVATE")
|
||||
|
|
|
|||
|
|
@ -181,7 +181,14 @@ in {
|
|||
'';
|
||||
};
|
||||
|
||||
system.activationScripts.ipa = stringAfter ["etc"] ''
|
||||
systemd.services."ipa-activation" = {
|
||||
wantedBy = [ "sysinit.target" ];
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
# libcurl requires a hard copy of the certificate
|
||||
if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
|
||||
rm -f /etc/ipa/ca.crt
|
||||
|
|
@ -200,6 +207,7 @@ in {
|
|||
EOF
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
services.sssd.config = ''
|
||||
[domain/${cfg.domain}]
|
||||
|
|
|
|||
|
|
@ -280,6 +280,7 @@ in
|
|||
wantedBy = [ "sysinit.target" ];
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
after = [ "systemd-sysusers.service" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
unitConfig.RequiresMountsFor = [ "/nix/store" "/run/wrappers" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
|
|
|||
|
|
@ -143,20 +143,15 @@ let
|
|||
};
|
||||
|
||||
# Paths listed in ReadWritePaths must exist before service is started
|
||||
mkActivationScript = name: cfg:
|
||||
mkTmpfiles = name: cfg:
|
||||
let
|
||||
install = "install -o ${cfg.user} -g ${cfg.group}";
|
||||
in
|
||||
nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''
|
||||
# Ensure that the home directory already exists
|
||||
# We can't assert createHome == true because that's not the case for root
|
||||
cd "${config.users.users.${cfg.user}.home}"
|
||||
# Create each directory separately to prevent root owned parent dirs
|
||||
${install} -d .config .config/borg
|
||||
${install} -d .cache .cache/borg
|
||||
'' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''
|
||||
${install} -d ${escapeShellArg cfg.repo}
|
||||
''));
|
||||
settings = { inherit (cfg) user group; };
|
||||
in lib.nameValuePair "borgbackup-job-${name}" ({
|
||||
"${config.users.users."${cfg.user}".home}/.config/borg".d = settings;
|
||||
"${config.users.users."${cfg.user}".home}/.cache/borg".d = settings;
|
||||
} // optionalAttrs (isLocalPath cfg.repo && !cfg.removableDevice) {
|
||||
"${cfg.repo}".d = settings;
|
||||
});
|
||||
|
||||
mkPassAssertion = name: cfg: {
|
||||
assertion = with cfg.encryption;
|
||||
|
|
@ -760,7 +755,7 @@ in {
|
|||
++ mapAttrsToList mkSourceAssertions jobs
|
||||
++ mapAttrsToList mkRemovableDeviceAssertions jobs;
|
||||
|
||||
system.activationScripts = mapAttrs' mkActivationScript jobs;
|
||||
systemd.tmpfiles.settings = mapAttrs' mkTmpfiles jobs;
|
||||
|
||||
systemd.services =
|
||||
# A job named "foo" is mapped to systemd.services.borgbackup-job-foo
|
||||
|
|
|
|||
|
|
@ -220,10 +220,16 @@ in
|
|||
logcheck = {};
|
||||
};
|
||||
|
||||
system.activationScripts.logcheck = ''
|
||||
mkdir -m 700 -p /var/{lib,lock}/logcheck
|
||||
chown ${cfg.user} /var/{lib,lock}/logcheck
|
||||
'';
|
||||
systemd.tmpfiles.settings.logcheck = {
|
||||
"/var/lib/logcheck".d = {
|
||||
mode = "700";
|
||||
inherit (cfg) user;
|
||||
};
|
||||
"/var/lock/logcheck".d = {
|
||||
mode = "700";
|
||||
inherit (cfg) user;
|
||||
};
|
||||
};
|
||||
|
||||
services.cron.systemCronJobs =
|
||||
let withTime = name: {timeArgs, ...}: timeArgs != null;
|
||||
|
|
|
|||
|
|
@ -137,7 +137,14 @@ in
|
|||
message = "networking.enableIPv6 must be true for yggdrasil to work";
|
||||
}];
|
||||
|
||||
system.activationScripts.yggdrasil = mkIf cfg.persistentKeys ''
|
||||
# This needs to be a separate service. The yggdrasil service fails if
|
||||
# this is put into its preStart.
|
||||
systemd.services.yggdrasil-persistent-keys = lib.mkIf cfg.persistentKeys {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [ "yggdrasil.service" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
if [ ! -e ${keysPath} ]
|
||||
then
|
||||
mkdir --mode=700 -p ${builtins.dirOf keysPath}
|
||||
|
|
@ -147,6 +154,7 @@ in
|
|||
> ${keysPath}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.yggdrasil = {
|
||||
description = "Yggdrasil Network Service";
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib) mkOption mkDefault types optionalString stringAfter;
|
||||
inherit (lib) mkOption mkDefault types optionalString;
|
||||
|
||||
cfg = config.boot.binfmt;
|
||||
|
||||
|
|
|
|||
|
|
@ -80,10 +80,17 @@ with lib;
|
|||
ACTION=="add|change", SUBSYSTEM=="input", ATTR{name}=="${cfg.device}", ATTR{device/speed}="${toString cfg.speed}", ATTR{device/sensitivity}="${toString cfg.sensitivity}"
|
||||
'';
|
||||
|
||||
system.activationScripts.trackpoint =
|
||||
''
|
||||
${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}"
|
||||
systemd.services.trackpoint = {
|
||||
wantedBy = [ "sysinit.target" ] ;
|
||||
before = [ "sysinit.target" "shutdown.target" ];
|
||||
conflicts = [ "shutdown.target" ];
|
||||
unitConfig.DefaultDependencies = false;
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
serviceConfig.ExecStart = ''
|
||||
${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}
|
||||
'';
|
||||
};
|
||||
})
|
||||
|
||||
(mkIf (cfg.emulateWheel) {
|
||||
|
|
|
|||
|
|
@ -85,11 +85,21 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
###### wrappers activation script
|
||||
# Services
|
||||
|
||||
system.activationScripts.vmwareWrappers =
|
||||
lib.stringAfter [ "specialfs" "users" ]
|
||||
''
|
||||
systemd.services."vmware-wrappers" = {
|
||||
description = "Create VMVare Wrappers";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [
|
||||
"vmware-authdlauncher.service"
|
||||
"vmware-networks-configuration.service"
|
||||
"vmware-networks.service"
|
||||
"vmware-usbarbitrator.service"
|
||||
];
|
||||
after = [ "systemd-sysusers.service" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
script = ''
|
||||
mkdir -p "${parentWrapperDir}"
|
||||
chmod 755 "${parentWrapperDir}"
|
||||
# We want to place the tmpdirs for the wrappers to the parent dir.
|
||||
|
|
@ -111,8 +121,7 @@ in
|
|||
ln --symbolic "$wrapperDir" "${wrapperDir}"
|
||||
fi
|
||||
'';
|
||||
|
||||
# Services
|
||||
};
|
||||
|
||||
systemd.services."vmware-authdlauncher" = {
|
||||
description = "VMware Authentication Daemon";
|
||||
|
|
|
|||
|
|
@ -13,9 +13,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
|||
'';
|
||||
|
||||
# ensure the directory to be monitored exists before incron is started
|
||||
system.activationScripts.incronTest = ''
|
||||
mkdir /test
|
||||
'';
|
||||
systemd.tmpfiles.settings.incron-test = {
|
||||
"/test".d = { };
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
|
|
|
|||
|
|
@ -13,10 +13,12 @@ in {
|
|||
# The only thing the client needs to do is download a file.
|
||||
client = { ... }: {
|
||||
services.davfs2.enable = true;
|
||||
system.activationScripts.davfs2-secrets = ''
|
||||
echo "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}" > /tmp/davfs2-secrets
|
||||
chmod 600 /tmp/davfs2-secrets
|
||||
'';
|
||||
systemd.tmpfiles.settings.nextcloud = {
|
||||
"/tmp/davfs2-secrets"."f+" = {
|
||||
mode = "0600";
|
||||
argument = "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}";
|
||||
};
|
||||
};
|
||||
virtualisation.fileSystems = {
|
||||
"/mnt/dav" = {
|
||||
device = "http://nextcloud/remote.php/dav/files/${adminuser}";
|
||||
|
|
|
|||
Loading…
Reference in a new issue