colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/restic-rest-server: Make the service socket activated

Browse Source
This commit is contained in:
MinerSebas 2024-03-16 08:30:18 +01:00
parent 7762c2233c
commit 9e1fe5cddd
2 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
nixos/modules/services/backup/restic-rest-server.nix
View File

@ -12,7 +12,7 @@ in
enable = mkEnableOption (lib.mdDoc "Restic REST Server"); enable = mkEnableOption (lib.mdDoc "Restic REST Server");
listenAddress = mkOption { listenAddress = mkOption {
default = ":8000"; default = "8000";
example = "127.0.0.1:8080"; example = "127.0.0.1:8080";
type = types.str; type = types.str;
description = lib.mdDoc "Listen on a specific IP address and port."; description = lib.mdDoc "Listen on a specific IP address and port.";
@ -61,14 +61,19 @@ in
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
assertions = [{
assertion = lib.substring 0 1 cfg.listenAddress != ":";
message = "The restic-rest-server now uses systemd socket activation, which expects only the Port number: services.restic.server.listenAddress = \"${lib.substring 1 6 cfg.listenAddress}\";";
}];
systemd.services.restic-rest-server = { systemd.services.restic-rest-server = {
description = "Restic REST Server"; description = "Restic REST Server";
after = [ "network.target" ]; after = [ "network.target" "restic-rest-server.socket" ];
requires = [ "restic-rest-server.socket" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
serviceConfig = { serviceConfig = {
ExecStart = '' ExecStart = ''
${cfg.package}/bin/rest-server \ ${cfg.package}/bin/rest-server \
--listen ${cfg.listenAddress} \
--path ${cfg.dataDir} \ --path ${cfg.dataDir} \
${optionalString cfg.appendOnly "--append-only"} \ ${optionalString cfg.appendOnly "--append-only"} \
${optionalString cfg.privateRepos "--private-repos"} \ ${optionalString cfg.privateRepos "--private-repos"} \
@ -84,6 +89,7 @@ in
LockPersonality = true; LockPersonality = true;
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateNetwork = true;
PrivateTmp = true; PrivateTmp = true;
PrivateUsers = true; PrivateUsers = true;
ProtectClock = true; ProtectClock = true;
@ -98,6 +104,7 @@ in
PrivateDevices = true; PrivateDevices = true;
ReadWritePaths = [ cfg.dataDir ]; ReadWritePaths = [ cfg.dataDir ];
RemoveIPC = true; RemoveIPC = true;
RestrictAddressFamilies = "none";
RestrictNamespaces = true; RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
@ -107,6 +114,11 @@ in
}; };
}; };
systemd.sockets.restic-rest-server = {
listenStreams = [ cfg.listenAddress ];
wantedBy = [ "sockets.target" ];
};
systemd.tmpfiles.rules = mkIf cfg.privateRepos [ systemd.tmpfiles.rules = mkIf cfg.privateRepos [
"f ${cfg.dataDir}/.htpasswd 0700 restic restic -" "f ${cfg.dataDir}/.htpasswd 0700 restic restic -"
]; ];

4
nixos/tests/restic-rest-server.nix
View File

@ -44,7 +44,7 @@ import ./make-test-python.nix (
services.restic.server = { services.restic.server = {
enable = true; enable = true;
extraFlags = [ "--no-auth" ]; extraFlags = [ "--no-auth" ];
listenAddress = ":8001"; listenAddress = "8001";
}; };
networking.firewall.allowedTCPPorts = [ 8001 ]; networking.firewall.allowedTCPPorts = [ 8001 ];
}; };
@ -68,7 +68,7 @@ import ./make-test-python.nix (
testScript = '' testScript = ''
restic_rest_server.start() restic_rest_server.start()
server.start() server.start()
restic_rest_server.wait_for_unit("restic-rest-server.service") restic_rest_server.wait_for_unit("restic-rest-server.socket")
restic_rest_server.wait_for_open_port(8001) restic_rest_server.wait_for_open_port(8001)
server.wait_for_unit("dbus.socket") server.wait_for_unit("dbus.socket")
server.fail( server.fail(