diff options
author | MinerSebas <scherthan_sebastian@web.de> | 2024-03-16 08:30:18 +0100 |
---|---|---|
committer | MinerSebas <scherthan_sebastian@web.de> | 2024-03-16 17:07:55 +0100 |
commit | 9e1fe5cddd5c786c0fcceff37a90d9837dc68bcb (patch) | |
tree | 16a27b4f6d7fe87a8af6b0de48c3051a1d7a9cc0 /nixos/modules/services/backup | |
parent | 7762c2233c801f22cb0e377dcef2a2b510609f9b (diff) |
nixos/restic-rest-server: Make the service socket activated
Diffstat (limited to 'nixos/modules/services/backup')
-rw-r--r-- | nixos/modules/services/backup/restic-rest-server.nix | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/nixos/modules/services/backup/restic-rest-server.nix b/nixos/modules/services/backup/restic-rest-server.nix index 34a2c51bbb27..c9d5a37116a1 100644 --- a/nixos/modules/services/backup/restic-rest-server.nix +++ b/nixos/modules/services/backup/restic-rest-server.nix @@ -12,7 +12,7 @@ in enable = mkEnableOption (lib.mdDoc "Restic REST Server"); listenAddress = mkOption { - default = ":8000"; + default = "8000"; example = "127.0.0.1:8080"; type = types.str; description = lib.mdDoc "Listen on a specific IP address and port."; @@ -61,14 +61,19 @@ in }; config = mkIf cfg.enable { + assertions = [{ + assertion = lib.substring 0 1 cfg.listenAddress != ":"; + message = "The restic-rest-server now uses systemd socket activation, which expects only the Port number: services.restic.server.listenAddress = \"${lib.substring 1 6 cfg.listenAddress}\";"; + }]; + systemd.services.restic-rest-server = { description = "Restic REST Server"; - after = [ "network.target" ]; + after = [ "network.target" "restic-rest-server.socket" ]; + requires = [ "restic-rest-server.socket" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = '' ${cfg.package}/bin/rest-server \ - --listen ${cfg.listenAddress} \ --path ${cfg.dataDir} \ ${optionalString cfg.appendOnly "--append-only"} \ ${optionalString cfg.privateRepos "--private-repos"} \ @@ -84,6 +89,7 @@ in LockPersonality = true; MemoryDenyWriteExecute = true; NoNewPrivileges = true; + PrivateNetwork = true; PrivateTmp = true; PrivateUsers = true; ProtectClock = true; @@ -98,6 +104,7 @@ in PrivateDevices = true; ReadWritePaths = [ cfg.dataDir ]; RemoveIPC = true; + RestrictAddressFamilies = "none"; RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; @@ -107,6 +114,11 @@ in }; }; + systemd.sockets.restic-rest-server = { + listenStreams = [ cfg.listenAddress ]; + wantedBy = [ "sockets.target" ]; + }; + systemd.tmpfiles.rules = mkIf cfg.privateRepos [ "f ${cfg.dataDir}/.htpasswd 0700 restic restic -" ]; |