nixos/fakeroute: run as unprivileged user
This commit is contained in:
parent
ed93c9d353
commit
7d263715bd
@ -1,10 +1,8 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
let
|
||||||
cfg = config.services.fakeroute;
|
cfg = config.services.fakeroute;
|
||||||
routeConf = pkgs.writeText "route.conf" (concatStringsSep "\n" cfg.route);
|
routeConf = pkgs.writeText "route.conf" (lib.concatStringsSep "\n" cfg.route);
|
||||||
|
|
||||||
in
|
in
|
||||||
|
|
||||||
@ -16,16 +14,10 @@ in
|
|||||||
|
|
||||||
services.fakeroute = {
|
services.fakeroute = {
|
||||||
|
|
||||||
enable = mkOption {
|
enable = lib.mkEnableOption (lib.mdDoc "the fakeroute service");
|
||||||
type = types.bool;
|
|
||||||
default = false;
|
|
||||||
description = lib.mdDoc ''
|
|
||||||
Whether to enable the fakeroute service.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
route = mkOption {
|
route = lib.mkOption {
|
||||||
type = types.listOf types.str;
|
type = with lib.types; listOf str;
|
||||||
default = [];
|
default = [];
|
||||||
example = [
|
example = [
|
||||||
"216.102.187.130"
|
"216.102.187.130"
|
||||||
@ -46,14 +38,16 @@ in
|
|||||||
|
|
||||||
###### implementation
|
###### implementation
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
config = lib.mkIf cfg.enable {
|
||||||
systemd.services.fakeroute = {
|
systemd.services.fakeroute = {
|
||||||
description = "Fakeroute Daemon";
|
description = "Fakeroute Daemon";
|
||||||
after = [ "network.target" ];
|
after = [ "network.target" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "forking";
|
Type = "forking";
|
||||||
User = "root";
|
User = "fakeroute";
|
||||||
|
DynamicUser = true;
|
||||||
|
AmbientCapabilities = [ "CAP_NET_RAW" ];
|
||||||
ExecStart = "${pkgs.fakeroute}/bin/fakeroute -f ${routeConf}";
|
ExecStart = "${pkgs.fakeroute}/bin/fakeroute -f ${routeConf}";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
Loading…
Reference in New Issue
Block a user