colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #198298 from yorickvP/int-rm-leading-zeroes

Browse Source
This commit is contained in:
Martin Weinelt 2022-10-29 12:37:51 +02:00 committed by GitHub
commit f3c660e95b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
12 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nixos/modules/security/acme/default.nix
View File

@ -26,8 +26,8 @@ let
Type = "oneshot"; Type = "oneshot";
User = user; User = user;
Group = mkDefault "acme"; Group = mkDefault "acme";
UMask = 0022; UMask = "0022";
StateDirectoryMode = 750; StateDirectoryMode = "750";
ProtectSystem = "strict"; ProtectSystem = "strict";
ReadWritePaths = [ ReadWritePaths = [
"/var/lib/acme" "/var/lib/acme"
@ -85,7 +85,7 @@ let
serviceConfig = commonServiceConfig // { serviceConfig = commonServiceConfig // {
StateDirectory = "acme/.minica"; StateDirectory = "acme/.minica";
BindPaths = "/var/lib/acme/.minica:/tmp/ca"; BindPaths = "/var/lib/acme/.minica:/tmp/ca";
UMask = 0077; UMask = "0077";
}; };
# Working directory will be /tmp # Working directory will be /tmp
@ -243,7 +243,7 @@ let
serviceConfig = commonServiceConfig // { serviceConfig = commonServiceConfig // {
Group = data.group; Group = data.group;
UMask = 0027; UMask = "0027";
StateDirectory = "acme/${cert}"; StateDirectory = "acme/${cert}";

2
nixos/modules/services/logging/journalwatch.nix
View File

@ -239,7 +239,7 @@ in {
Type = "oneshot"; Type = "oneshot";
# requires a relative directory name to create beneath /var/lib # requires a relative directory name to create beneath /var/lib
StateDirectory = user; StateDirectory = user;
StateDirectoryMode = 0750; StateDirectoryMode = "0750";
ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail"; ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail";
# lowest CPU and IO priority, but both still in best-effort class to prevent starvation # lowest CPU and IO priority, but both still in best-effort class to prevent starvation
Nice=19; Nice=19;

2
nixos/modules/services/matrix/appservice-discord.nix
View File

@ -137,7 +137,7 @@ in {
PrivateTmp = true; PrivateTmp = true;
WorkingDirectory = appDir; WorkingDirectory = appDir;
StateDirectory = baseNameOf dataDir; StateDirectory = baseNameOf dataDir;
UMask = 0027; UMask = "0027";
EnvironmentFile = cfg.environmentFile; EnvironmentFile = cfg.environmentFile;
ExecStart = '' ExecStart = ''

2
nixos/modules/services/matrix/mautrix-telegram.nix
View File

@ -162,7 +162,7 @@ in {
PrivateTmp = true; PrivateTmp = true;
WorkingDirectory = pkgs.mautrix-telegram; # necessary for the database migration scripts to be found WorkingDirectory = pkgs.mautrix-telegram; # necessary for the database migration scripts to be found
StateDirectory = baseNameOf dataDir; StateDirectory = baseNameOf dataDir;
UMask = 0027; UMask = "0027";
EnvironmentFile = cfg.environmentFile; EnvironmentFile = cfg.environmentFile;
ExecStart = '' ExecStart = ''

2
nixos/modules/services/misc/geoipupdate.nix
View File

@ -183,7 +183,7 @@ in
DynamicUser = true; DynamicUser = true;
ReadWritePaths = cfg.settings.DatabaseDirectory; ReadWritePaths = cfg.settings.DatabaseDirectory;
RuntimeDirectory = "geoipupdate"; RuntimeDirectory = "geoipupdate";
RuntimeDirectoryMode = 0700; RuntimeDirectoryMode = "0700";
CapabilityBoundingSet = ""; CapabilityBoundingSet = "";
PrivateDevices = true; PrivateDevices = true;
PrivateMounts = true; PrivateMounts = true;

2
nixos/modules/services/misc/mx-puppet-discord.nix
View File

@ -107,7 +107,7 @@ in {
PrivateTmp = true; PrivateTmp = true;
WorkingDirectory = pkgs.mx-puppet-discord; WorkingDirectory = pkgs.mx-puppet-discord;
StateDirectory = baseNameOf dataDir; StateDirectory = baseNameOf dataDir;
UMask = 0027; UMask = "0027";
ExecStart = '' ExecStart = ''
${pkgs.mx-puppet-discord}/bin/mx-puppet-discord \ ${pkgs.mx-puppet-discord}/bin/mx-puppet-discord \

2
nixos/modules/services/misc/rmfakecloud.nix
View File

@ -138,7 +138,7 @@ in {
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
WorkingDirectory = serviceDataDir; WorkingDirectory = serviceDataDir;
StateDirectory = baseNameOf serviceDataDir; StateDirectory = baseNameOf serviceDataDir;
UMask = 0027; UMask = "0027";
}; };
}; };
}; };

2
nixos/modules/services/monitoring/parsedmarc.nix
View File

@ -494,7 +494,7 @@ in
Group = "parsedmarc"; Group = "parsedmarc";
DynamicUser = true; DynamicUser = true;
RuntimeDirectory = "parsedmarc"; RuntimeDirectory = "parsedmarc";
RuntimeDirectoryMode = 0700; RuntimeDirectoryMode = "0700";
CapabilityBoundingSet = ""; CapabilityBoundingSet = "";
PrivateDevices = true; PrivateDevices = true;
PrivateMounts = true; PrivateMounts = true;

2
nixos/modules/services/web-apps/bookstack.nix
View File

@ -372,7 +372,7 @@ in {
User = user; User = user;
WorkingDirectory = "${bookstack}"; WorkingDirectory = "${bookstack}";
RuntimeDirectory = "bookstack/cache"; RuntimeDirectory = "bookstack/cache";
RuntimeDirectoryMode = 0700; RuntimeDirectoryMode = "0700";
}; };
path = [ pkgs.replace-secret ]; path = [ pkgs.replace-secret ];
script = script =

4
nixos/modules/services/web-apps/discourse.nix
View File

@ -798,13 +798,13 @@ in
"public" "public"
"sockets" "sockets"
]; ];
RuntimeDirectoryMode = 0750; RuntimeDirectoryMode = "0750";
StateDirectory = map (p: "discourse/" + p) [ StateDirectory = map (p: "discourse/" + p) [
"uploads" "uploads"
"backups" "backups"
"tmp" "tmp"
]; ];
StateDirectoryMode = 0750; StateDirectoryMode = "0750";
LogsDirectory = "discourse"; LogsDirectory = "discourse";
TimeoutSec = "infinity"; TimeoutSec = "infinity";
Restart = "on-failure"; Restart = "on-failure";

2
nixos/modules/services/web-apps/keycloak.nix
View File

@ -616,7 +616,7 @@ in
Group = "keycloak"; Group = "keycloak";
DynamicUser = true; DynamicUser = true;
RuntimeDirectory = "keycloak"; RuntimeDirectory = "keycloak";
RuntimeDirectoryMode = 0700; RuntimeDirectoryMode = "0700";
AmbientCapabilities = "CAP_NET_BIND_SERVICE"; AmbientCapabilities = "CAP_NET_BIND_SERVICE";
}; };
script = '' script = ''

2
nixos/modules/services/web-apps/snipe-it.nix
View File

@ -394,7 +394,7 @@ in {
User = user; User = user;
WorkingDirectory = snipe-it; WorkingDirectory = snipe-it;
RuntimeDirectory = "snipe-it/cache"; RuntimeDirectory = "snipe-it/cache";
RuntimeDirectoryMode = 0700; RuntimeDirectoryMode = "0700";
}; };
path = [ pkgs.replace-secret ]; path = [ pkgs.replace-secret ];
script = script =