colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

common/fs: mount curlftpfs using fuse3

Browse Source
This commit is contained in:
Colin
2024-08-06 04:11:57 +00:00
parent 0655b6906c
commit 646c2dd85a
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
hosts/common/fs.nix
View File

@@ -171,11 +171,18 @@ let
systemdName = utils.escapeSystemdPath localPath; systemdName = utils.escapeSystemdPath localPath;
in { in {
sane.programs.curlftpfs.enableFor.system = true; sane.programs.curlftpfs.enableFor.system = true;
system.fsPackages = [
config.sane.programs.curlftpfs.package
];
fileSystems."${localPath}" = { fileSystems."${localPath}" = {
device = "ftp://servo-hn:/${subdir}"; device = "curlftpfs#ftp://servo-hn:/${subdir}";
noCheck = true; noCheck = true;
fsType = "fuse.curlftpfs"; fsType = "fuse3";
options = fsOpts.ftp ++ fsOpts.noauto; options = fsOpts.ftp ++ fsOpts.noauto ++ [
# drop_privileges: after `mount.fuse3` opens /dev/fuse, it will drop all capabilities before invoking sshfs
"drop_privileges"
"auto_unmount" #< ensures that when the fs exits, it releases its mountpoint. then systemd can recognize it as failed.
];
# fsType = "nfs"; # fsType = "nfs";
# options = fsOpts.nfs ++ fsOpts.lazyMount; # options = fsOpts.nfs ++ fsOpts.lazyMount;
}; };
@@ -191,10 +198,11 @@ let
mount.unitConfig.OnSuccess = [ "${systemdName}-restart-timer.target" ]; mount.unitConfig.OnSuccess = [ "${systemdName}-restart-timer.target" ];
mount.mountConfig.TimeoutSec = "10s"; mount.mountConfig.TimeoutSec = "10s";
mount.mountConfig.ExecSearchPath = [ "/run/current-system/sw/bin" ];
mount.mountConfig.User = "colin"; mount.mountConfig.User = "colin";
mount.mountConfig.AmbientCapabilities = "CAP_SYS_ADMIN"; mount.mountConfig.AmbientCapabilities = "CAP_SETPCAP CAP_SYS_ADMIN";
# hardening (systemd-analyze security mnt-servo-playground.mount) # hardening (systemd-analyze security mnt-servo-playground.mount)
mount.mountConfig.CapabilityBoundingSet = "CAP_SYS_ADMIN"; mount.mountConfig.CapabilityBoundingSet = "CAP_SETPCAP CAP_SYS_ADMIN";
mount.mountConfig.LockPersonality = true; mount.mountConfig.LockPersonality = true;
mount.mountConfig.MemoryDenyWriteExecute = true; mount.mountConfig.MemoryDenyWriteExecute = true;
mount.mountConfig.NoNewPrivileges = true; mount.mountConfig.NoNewPrivileges = true;