cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/navidrome: ensure data & cache dirs exist with valid permissions

Browse source
This commit is contained in:
nu-nu-ko 2024-03-01 12:56:38 +13:00 committed by nuko
parent ffc0d8bf58
commit 7519d230b5
No known key found for this signature in database
1 changed files with 65 additions and 54 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

119
nixos/modules/services/audio/navidrome.nix
View file

@ -6,11 +6,7 @@
}: }:
let let
inherit (lib) inherit (lib) mkEnableOption mkPackageOption mkOption;
mkEnableOption
mkPackageOption
mkOption
;
inherit (lib.types) bool str; inherit (lib.types) bool str;
cfg = config.services.navidrome; cfg = config.services.navidrome;
settingsFormat = pkgs.formats.json { }; settingsFormat = pkgs.formats.json { };
@ -58,57 +54,72 @@ in
config = config =
let let
inherit (lib) mkIf optional getExe; inherit (lib) mkIf optional getExe;
WorkingDirectory = "/var/lib/navidrome";
in in
mkIf cfg.enable { mkIf cfg.enable {
systemd.services.navidrome = { systemd = {
description = "Navidrome Media Server"; tmpfiles.settings.navidromeDirs = {
after = [ "network.target" ]; "${cfg.settings.DataFolder or WorkingDirectory}"."d" = {
wantedBy = [ "multi-user.target" ]; mode = "700";
serviceConfig = { inherit (cfg) user group;
ExecStart = '' };
${getExe cfg.package} --configfile ${settingsFormat.generate "navidrome.json" cfg.settings} "${cfg.settings.CacheFolder or (WorkingDirectory + "/cache")}"."d" = {
''; mode = "700";
User = cfg.user; inherit (cfg) user group;
Group = cfg.group; };
StateDirectory = "navidrome"; };
WorkingDirectory = "/var/lib/navidrome"; services.navidrome = {
RuntimeDirectory = "navidrome"; description = "Navidrome Media Server";
RootDirectory = "/run/navidrome"; after = [ "network.target" ];
ReadWritePaths = ""; wantedBy = [ "multi-user.target" ];
BindPaths = optional (cfg.settings ? DataFolder) cfg.settings.DataFolder; serviceConfig = {
BindReadOnlyPaths = [ ExecStart = ''
# navidrome uses online services to download additional album metadata / covers ${getExe cfg.package} --configfile ${settingsFormat.generate "navidrome.json" cfg.settings}
"${ '';
config.environment.etc."ssl/certs/ca-certificates.crt".source User = cfg.user;
}:/etc/ssl/certs/ca-certificates.crt" Group = cfg.group;
builtins.storeDir StateDirectory = "navidrome";
"/etc" inherit WorkingDirectory;
] ++ optional (cfg.settings ? MusicFolder) cfg.settings.MusicFolder; RuntimeDirectory = "navidrome";
CapabilityBoundingSet = ""; RootDirectory = "/run/navidrome";
RestrictAddressFamilies = [ ReadWritePaths = "";
"AF_UNIX" BindPaths =
"AF_INET" optional (cfg.settings ? DataFolder) cfg.settings.DataFolder
"AF_INET6" ++ optional (cfg.settings ? CacheFolder) cfg.settings.CacheFolder;
]; BindReadOnlyPaths = [
RestrictNamespaces = true; # navidrome uses online services to download additional album metadata / covers
PrivateDevices = true; "${
PrivateUsers = true; config.environment.etc."ssl/certs/ca-certificates.crt".source
ProtectClock = true; }:/etc/ssl/certs/ca-certificates.crt"
ProtectControlGroups = true; builtins.storeDir
ProtectHome = true; "/etc"
ProtectKernelLogs = true; ] ++ optional (cfg.settings ? MusicFolder) cfg.settings.MusicFolder;
ProtectKernelModules = true; CapabilityBoundingSet = "";
ProtectKernelTunables = true; RestrictAddressFamilies = [
SystemCallArchitectures = "native"; "AF_UNIX"
SystemCallFilter = [ "AF_INET"
"@system-service" "AF_INET6"
"~@privileged" ];
]; RestrictNamespaces = true;
RestrictRealtime = true; PrivateDevices = true;
LockPersonality = true; PrivateUsers = true;
MemoryDenyWriteExecute = true; ProtectClock = true;
UMask = "0066"; ProtectControlGroups = true;
ProtectHostname = true; ProtectHome = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
RestrictRealtime = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
UMask = "0066";
ProtectHostname = true;
};
}; };
}; };