colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

hosts/common: clean up the journald persistence to support both *private* or plaintext storage, by config

Browse Source
This commit is contained in:
Colin
2024-11-13 09:14:30 +00:00
parent cffc826746
commit 8d1c714ba0
1 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
hosts/common/systemd.nix
View File

@@ -1,4 +1,4 @@
{ ... }: { config, lib, pkgs, ... }:
let let
# N.B.: systemd doesn't like to honor its timeout settings. # N.B.: systemd doesn't like to honor its timeout settings.
# a timeout of 20s is actually closer to 70s, # a timeout of 20s is actually closer to 70s,
@@ -46,15 +46,15 @@ in
}) })
''; '';
# persist to PLAINTEXT, i.e. WORLD-READABLE sane.persist.sys.byPath."/var/log/journal" = {
# sane.persist.sys.byStore.plaintext = [ # prefer to persist to private, because the journal can have sensitive info in it.
# { mode = "0755"; path = "/var/log/journal"; method = "bind"; } # but plaintext also works for scenarios where the system can't be unlocked.
# ]; store = "private";
# store = "plaintext";
# persist to private: # ordering of bind mounts is tricky for private store, so prefer symlink
sane.persist.sys.byStore.private = [ method = "symlink";
{ mode = "0755"; path = "/var/log/journal"; } acl.mode = "0750";
]; };
# systemd-journal-flush.service switches journald from volatile to persistent storage partway through boot # systemd-journal-flush.service switches journald from volatile to persistent storage partway through boot
# ExecStart=journalctl --flush # ExecStart=journalctl --flush
@@ -75,8 +75,12 @@ in
description = "flush early logging data to persistent storage, but later in the boot than normal to avoid cycles"; description = "flush early logging data to persistent storage, but later in the boot than normal to avoid cycles";
wantedBy = [ "systemd-journal-flush.service" ]; wantedBy = [ "systemd-journal-flush.service" ];
serviceConfig.ExecStart = "journalctl --flush"; serviceConfig.ExecStart = "journalctl --flush";
# ensure /var/log/journal symlink exists before starting:
serviceConfig.ExecStartPre = "-${lib.getExe' pkgs.systemd "systemd-tmpfiles"} --prefix=/var/log/journal --boot --create --graceful";
unitConfig.DefaultDependencies = false; unitConfig.DefaultDependencies = false;
unitConfig.RequiresMountsFor = [ "/mnt/persist/private" ]; unitConfig.RequiresMountsFor = [
config.sane.persist.sys.byPath."/var/log/journal".store.origin
];
}; };
services.journald.extraConfig = '' services.journald.extraConfig = ''