Projects/roowho2
1
2
Fork 0
Code Issues 43 Pull Requests Actions Releases Activity

nix/module: reuse systemd units
Build and test / check (push) Successful in 1m14s
Details
Build and test / build (push) Successful in 2m29s
Details
Build and test / test (push) Successful in 4m25s
Details
Build and test / docs (push) Successful in 6m23s
Details

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2026-07-30 19:24:50 +09:00
parent 2271aedfd3
commit 3e8928ef46
2 changed files with 18 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/systemd/roowho2.service
+5 -3
View File
@@ -13,20 +13,21 @@ ExecStart=/usr/bin/roowhod
ConfigurationDirectory=roowho2
Environment=DBUS_SYSTEM_BUS_ADDRESS=unix:path=/run/dbus/system_bus_socket
# Finger needs CAP_DAC_READ_SEARCH to look for various files in user's home directories.
AmbientCapabilities=CAP_DAC_READ_SEARCH
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
PrivateUsers=false
ProtectHome=false
# walld needs access to tty/pts devices.
DeviceAllow=char-tty rw
DeviceAllow=char-pts rw
PrivateDevices=false
DevicePolicy=closed
# Might use /proc/<pid>/stat to determine the caller's PID + UID
ProtectProc=default
DevicePolicy=closed
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
@@ -44,6 +45,7 @@ RemoveIPC=true
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_UNIX
# Needed for auditd socket
RestrictAddressFamilies=AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
nix/module.nix
+13 -97
View File
@@ -265,60 +265,21 @@ in {
};
};
systemd.sockets.roowho2-client = {
wantedBy = [ "sockets.target" ];
description = "Roowho2 Client Communication Socket";
listenStreams = [ "/run/roowho2/roowho2.varlink" ];
socketConfig = {
Service = "roowho2.service";
FileDescriptorName = "client_socket";
};
};
systemd.packages = [ cfg.package ];
systemd.sockets.roowho2-client.wantedBy = lib.mkIf cfg.settings.rwhod.enable [ "sockets.target" ];
systemd.sockets.roowho2-rwhod = lib.mkIf cfg.settings.rwhod.enable {
wantedBy = [ "sockets.target" ];
description = "Roowho2 Rwhod Socket";
listenDatagrams = [ "0.0.0.0:513" ];
socketConfig = {
Service = "roowho2.service";
FileDescriptorName = "rwhod_socket";
Broadcast = true;
} // cfg.settings.rwhod.socketConfig;
inherit (cfg.settings.rwhod) socketConfig;
};
systemd.sockets.roowho2-audit = lib.mkIf (cfg.settings.rwhod.enable && cfg.settings.rwhod.realtime_updates) {
wantedBy = [ "sockets.target" ];
description = "Roowho2 Audit Netlink Socket";
unitConfig = {
ConditionKernelCommandLine = [
"!audit=0"
"!audit=off"
];
};
socketConfig = {
Service = "roowho2.service";
FileDescriptorName = "audit_socket";
ListenNetlink = "audit 1"; # AUDIT_NLGRP_READLOG
};
};
# systemd.sockets.roowho2-fingerd = lib.mkIf cfg.settings.fingerd.enable && cfg.settings.fingerd.enableRemoteFinger {
# wantedBy = [ "sockets.target" ];
# description = "Roowho2 Fingerd Socket";
# listenStreams = [ "0.0.0.0:79" ];
# socketConfig = {
# Service = "roowho2.service";
# FileDescriptorName = "fingerd_socket";
# } // cfg.settings.fingerd.socketConfig;
# };
systemd.sockets.roowho2-audit.wantedBy = lib.mkIf (cfg.settings.rwhod.enable && cfg.settings.rwhod.realtime_updates) [ "sockets.target" ];
# systemd.sockets.roowho2-fingerd.wantedBy = lib.mkIf cfg.settings.fingerd.enable [ "sockets.target" ];
systemd.services.roowho2 = {
# rwhod needs the network devices to be available for enumeration before starting.
after = lib.mkIf cfg.settings.rwhod.enable [ "network-online.target" ];
wants = lib.mkIf cfg.settings.rwhod.enable [ "network-online.target" ];
# Override the dbus system bus address to be where we bind-mounted it in the chroot.
environment.DBUS_SYSTEM_BUS_ADDRESS = "unix:path=/run/dbus/system_bus_socket";
serviceConfig = {
Type = "notify";
ExecStart = let
configFile = lib.pipe cfg.settings [
(lib.filterAttrsRecursive (n: v: v != null))
@@ -328,55 +289,9 @@ in {
})
(format.generate "roowho2-config.toml")
];
in "${lib.getExe' cfg.package "roowhod"} --config ${configFile}";
Restart = "on-failure";
DynamicUser = true;
ConfigurationDirectory = [ "roowho2" ];
# NOTE: roowho2 might at some point need to read from home directories
# to get user settings, so let's keep these disabled for now.
# PrivateUsers = true;
# ProtectHome = true;
# NOTE: We need this capability to be able to read inside the home directories of users without
# them needing to open their homedirs to the rest of the system.
AmbientCapabilities = [ "CAP_DAC_READ_SEARCH" ];
CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" ];
DeviceAllow = "";
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
# NOTE: all ipc traffic is served through the socket activation fds or provided by systemd
PrivateIPC = true;
PrivateMounts = true;
PrivateTmp = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = "strict";
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
"AF_NETLINK"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SocketBindDeny = "any";
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
in [
""
"${lib.getExe' cfg.package "roowhod"} --config ${configFile}"
];
RuntimeDirectory = "roowho2/root-mnt";
@@ -389,6 +304,9 @@ in {
# NOTE: need logind socket for utmp entries
"/run/systemd"
# NOTE: need dbus socket for polkit authorization
"-/run/dbus/system_bus_socket"
"/home"
# NOTE: finger might need access to mail directories
@@ -403,8 +321,6 @@ in {
] ++ lib.optionals cfg.settings.fingerd.enable [
cfg.settings.fingerd.ignore_list_path
]);
UMask = "0077";
};
};