Merge pull request #292477 from nu-nu-ko/nixos-komga-hardening
nixos/komga: add service hardening and misc format changes.
This commit is contained in:
commit
119099506c
|
@ -1,99 +1,122 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.services.komga;
|
||||
|
||||
in {
|
||||
inherit (lib) mkOption mkEnableOption maintainers;
|
||||
inherit (lib.types) port str bool;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.komga = {
|
||||
enable = mkEnableOption (lib.mdDoc "Komga, a free and open source comics/mangas media server");
|
||||
enable = mkEnableOption "Komga, a free and open source comics/mangas media server";
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
type = port;
|
||||
default = 8080;
|
||||
description = lib.mdDoc ''
|
||||
The port that Komga will listen on.
|
||||
'';
|
||||
description = "The port that Komga will listen on.";
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
type = str;
|
||||
default = "komga";
|
||||
description = lib.mdDoc ''
|
||||
User account under which Komga runs.
|
||||
'';
|
||||
description = "User account under which Komga runs.";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
type = str;
|
||||
default = "komga";
|
||||
description = lib.mdDoc ''
|
||||
Group under which Komga runs.
|
||||
'';
|
||||
description = "Group under which Komga runs.";
|
||||
};
|
||||
|
||||
stateDir = mkOption {
|
||||
type = types.str;
|
||||
type = str;
|
||||
default = "/var/lib/komga";
|
||||
description = lib.mdDoc ''
|
||||
State and configuration directory Komga will use.
|
||||
'';
|
||||
description = "State and configuration directory Komga will use.";
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
type = bool;
|
||||
default = false;
|
||||
description = lib.mdDoc ''
|
||||
Whether to open the firewall for the port in {option}`services.komga.port`.
|
||||
'';
|
||||
description = "Whether to open the firewall for the port in {option}`services.komga.port`.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
config =
|
||||
let
|
||||
inherit (lib) mkIf getExe;
|
||||
in
|
||||
mkIf cfg.enable {
|
||||
|
||||
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
|
||||
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
|
||||
|
||||
users.groups = mkIf (cfg.group == "komga") {
|
||||
komga = {};
|
||||
};
|
||||
users.groups = mkIf (cfg.group == "komga") { komga = { }; };
|
||||
|
||||
users.users = mkIf (cfg.user == "komga") {
|
||||
komga = {
|
||||
group = cfg.group;
|
||||
home = cfg.stateDir;
|
||||
description = "Komga Daemon user";
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.komga = {
|
||||
environment = {
|
||||
SERVER_PORT = builtins.toString cfg.port;
|
||||
KOMGA_CONFIGDIR = cfg.stateDir;
|
||||
users.users = mkIf (cfg.user == "komga") {
|
||||
komga = {
|
||||
group = cfg.group;
|
||||
home = cfg.stateDir;
|
||||
description = "Komga Daemon user";
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
description = "Komga is a free and open source comics/mangas media server";
|
||||
systemd.services.komga = {
|
||||
environment = {
|
||||
SERVER_PORT = builtins.toString cfg.port;
|
||||
KOMGA_CONFIGDIR = cfg.stateDir;
|
||||
};
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
description = "Komga is a free and open source comics/mangas media server";
|
||||
|
||||
serviceConfig = {
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
|
||||
Type = "simple";
|
||||
Restart = "on-failure";
|
||||
ExecStart = "${pkgs.komga}/bin/komga";
|
||||
serviceConfig = {
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
|
||||
StateDirectory = mkIf (cfg.stateDir == "/var/lib/komga") "komga";
|
||||
Type = "simple";
|
||||
Restart = "on-failure";
|
||||
ExecStart = getExe pkgs.komga;
|
||||
|
||||
StateDirectory = mkIf (cfg.stateDir == "/var/lib/komga") "komga";
|
||||
|
||||
RemoveIPC = true;
|
||||
NoNewPrivileges = true;
|
||||
CapabilityBoundingSet = "";
|
||||
SystemCallFilter = [ "@system-service" ];
|
||||
ProtectSystem = "full";
|
||||
PrivateTmp = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectClock = true;
|
||||
ProcSubset = "pid";
|
||||
PrivateUsers = true;
|
||||
PrivateDevices = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_NETLINK"
|
||||
];
|
||||
LockPersonality = true;
|
||||
RestrictNamespaces = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectKernelModules = true;
|
||||
SystemCallArchitectures = "native";
|
||||
RestrictSUIDSGID = true;
|
||||
RestrictRealtime = true;
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
meta.maintainers = with maintainers; [ govanify ];
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user