From a2cd4d6ad139672787c02bc318ec4d5cd2165ac0 Mon Sep 17 00:00:00 2001 From: h7x4 Date: Mon, 10 Jun 2024 00:59:41 +0200 Subject: [PATCH] modules/socketActivation: misc improvement --- modules/socketActivation.nix | 108 +++++++++++++++++++++++++---------- 1 file changed, 77 insertions(+), 31 deletions(-) diff --git a/modules/socketActivation.nix b/modules/socketActivation.nix index 709a1a6..5382ca3 100644 --- a/modules/socketActivation.nix +++ b/modules/socketActivation.nix @@ -1,19 +1,18 @@ -{ config, pkgs, lib, ... }: +{ options, config, pkgs, lib, ... }: let inherit (lib) mkOption types mdDoc; - cfg = lib.filterAttrs (_: value: value.enable) config.local.socketActivation; in { - options.local.socketActivation = mkOption { + options.socketActivation = mkOption { type = types.attrsOf (types.submodule ({ name, ... }: { options = { - enable = lib.mkEnableOption "socket activation for "; + enable = lib.mkEnableOption "socket activation for a systemd service"; service = mkOption { type = types.str; default = name; defaultText = ""; - example = "myservice"; + example = "gitea"; description = mdDoc "Systemd service name"; }; @@ -23,7 +22,6 @@ in example = false; description = mdDoc '' Whether to isolate the network of the original service. - This is recommended, but might be impractical if the original service also uses networking for its own operation. ''; @@ -34,29 +32,28 @@ in example = "localhost:8080"; description = mdDoc '' Socket that the original service is listening to. - - This could be a TCP or UNIX socket. + This could be an INET/6 or UNIX socket. ''; }; newSocketAddress = mkOption { type = with types; either str port; + default = "/run/${name}.socket"; + defaultText = "/run/.socket"; example = "localhost:8080"; description = mdDoc '' - Addres of the new systemd socket. - - This could be a TCP or UNIX socket. + Address of the new systemd socket. + This could be an INET/6 or UNIX socket. ''; }; connectionsMax = mkOption { - type = types.int; + type = types.ints.unsigned; default = 256; example = 1024; description = mdDoc '' Sets the maximum number of simultaneous connections. If the limit of concurrent connections is reached further connections will be refused. - See ''; }; @@ -68,38 +65,87 @@ in description = mdDoc '' Amount of inactivity time, before systemd shuts down the service. If this is set to `null`, the service will never stop. - See ''; }; + + openFirewall = mkOption { + type = types.bool; + default = false; + example = true; + description = mdDoc '' + Whether to open the firewall for {var}`newSocketAddress` + ''; + }; + + createNginxUpstream = mkOption { + type = types.bool; + default = true; + example = false; + description = mdDoc '' + Whether to create an http upstream entry for {var}`newSocketAddress` in nginx. + See + ''; + }; + + extraSocketConfig = mkOption { + type = types.attrs; # TODO: not exactly sure how to type this, + # maybe reexposing this through the module is a bad idea? + default = { }; + example = { + KeepAlive = true; + MaxConnectionsPerSource = 3; + Priority = 2; + }; + description = mdDoc '' + Extra configuration to go into the [socket] section of the systemd unit. + See + ''; + }; }; })); - description = mdDoc "Forcefully socket activated systemd services"; + description = mdDoc "Socket activated services using {command}`systemd-socket-proxyd`."; default = { }; }; - config = { - assertions = lib.mapAttrsToList (name: value: { - # NOTE: This assertion is missing a lot of invalid cases. - # The original socket address could've been "localhost:1234" and now only 1234, + config = let + activeServices = lib.filterAttrs (_: value: value.enable) config.socketActivation; + foreachService = f: lib.mapAttrsToList f activeServices; + in { + assertions = foreachService (name: value: { + # NOTE: This assertion is just covering for the most basic invalid usecases, but misses a lot. + # The original socket address could've been "localhost:1234" and now only "1234", # while still meaning the same thing. - # Also, if the originalSocketAddress and newSocketAddress is the same UNIX socket path - # it doesn't matter whether they're in different namespaces AFAIK, they'll still clash. - assertion = !value.privateNamespace -> (value.originalSocketAddress != value.newSocketAddress); + assertion = lib.any (b: b) [ + value.privateNamespace + # If this is a UNIX socket, the paths themself + # would clash even if in a private namespace + (lib.hasPrefix "/" value.originalSocketAddress) + (lib.hasPrefix "@" value.originalSocketAddress) + ] -> (value.originalSocketAddress != value.newSocketAddress); message = '' - The new proxied socket address of "${name}" clashes with its original socket address. - Either enable `privateNamespace` to isolate the original service' network, or use a separate - socket address. + The new proxied socket of "${name}" has a new socket address of "${toString value.newSocketAddress}", + which clashes with its original address of "${toString value.originalSocketAddress}". + Either enable privateNamespace to isolate the original service' network, or use a separate socket address. ''; - }) cfg; + }); - systemd = lib.mkMerge ((lib.flip lib.mapAttrsToList) cfg (name: value: let + services.nginx.upstreams = let + servicesWithNginxUpstream = lib.filterAttrs (_: value: value.createNginxUpstream) activeServices; + in lib.mapAttrsToList (name: value: let + protocol = if lib.any (p: lib.hasPrefix p value.newSocketAddress) [ "/" "@" ] then "unix" else "http"; + in { + ${name}.servers."${protocol}:${value.newSocketAddress}" = { }; + }) servicesWithNginxUpstream; + + systemd = lib.mkMerge (foreachService (name: value: let originalService = config.systemd.services.${value.service}; in { sockets."${name}-proxy" = { wantedBy = [ "sockets.target" ]; socketConfig = { ListenStream = value.newSocketAddress; + MaxConnections = value.connectionsMax; }; }; @@ -110,9 +156,7 @@ in ]; after = requires; - unitConfig = lib.mkIf value.privateNamespace { - JoinsNamespaceOf = "${value.service}.service"; - }; + unitConfig.JoinsNamespaceOf = lib.mkIf value.privateNamespace "${value.service}.service"; serviceConfig = { ExecStart = let @@ -120,7 +164,7 @@ in exit-idle-time = if value.exitIdleTime != null then value.exitIdleTime else "infinity"; connections-max = value.connectionsMax; }; - in ''${pkgs.systemd}/lib/systemd/systemd-socket-proxyd ${args} "${cfg.${name}.originalSocketAddress}"''; + in ''${pkgs.systemd}/lib/systemd/systemd-socket-proxyd ${args} "${value.originalSocketAddress}"''; CapabilityBoundingSet = ""; LockPersonality = true; @@ -171,4 +215,6 @@ in }; })); }; + + meta.maintainers = with lib.maintainers; [ h7x4 ]; }