colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

goaccess: fix missing state dir

Browse Source
This commit is contained in:
Colin
2024-04-26 08:47:09 +00:00
parent 593268f620
commit 95447eb765
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
hosts/by-name/servo/services/goaccess.nix
View File

@@ -20,7 +20,7 @@
--ignore-panel=HOSTS \ --ignore-panel=HOSTS \
--ws-url=wss://sink.uninsane.org:443/ws \ --ws-url=wss://sink.uninsane.org:443/ws \
--port=7890 \ --port=7890 \
-o /var/lib/uninsane/sink/index.html -o /var/lib/goaccess/index.html
''; '';
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Type = "simple"; Type = "simple";
@@ -28,17 +28,19 @@
RestartSec = "10s"; RestartSec = "10s";
# hardening # hardening
WorkingDirectory = "/tmp"; # TODO: run as `goaccess` user and add `goaccess` user to group `nginx`.
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateDevices = "yes";
PrivateTmp = true; PrivateTmp = true;
ProtectHome = "read-only"; ProtectHome = "read-only";
ProtectSystem = "strict";
SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @reboot @resources @setuid @swap @raw-io";
ReadOnlyPaths = "/";
ReadWritePaths = [ "/proc/self" "/var/lib/uninsane/sink" ];
PrivateDevices = "yes";
ProtectKernelModules = "yes"; ProtectKernelModules = "yes";
ProtectKernelTunables = "yes"; ProtectKernelTunables = "yes";
ProtectSystem = "strict";
ReadOnlyPaths = [ "/var/log/nginx" ];
ReadWritePaths = [ "/proc/self" "/var/lib/goaccess" ];
StateDirectory = "goaccess";
SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @reboot @resources @setuid @swap @raw-io";
WorkingDirectory = "/var/lib/goaccess";
}; };
after = [ "network.target" ]; after = [ "network.target" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
@@ -49,7 +51,7 @@
addSSL = true; addSSL = true;
enableACME = true; enableACME = true;
# inherit kTLS; # inherit kTLS;
root = "/var/lib/uninsane/sink"; root = "/var/lib/goaccess";
locations."/ws" = { locations."/ws" = {
proxyPass = "http://127.0.0.1:7890"; proxyPass = "http://127.0.0.1:7890";