summaryrefslogtreecommitdiffstats
path: root/nixos/modules
diff options
context:
space:
mode:
Diffstat (limited to 'nixos/modules')
-rw-r--r--nixos/modules/services/mail/rspamd.nix2
-rw-r--r--nixos/modules/services/misc/nix-daemon.nix2
-rw-r--r--nixos/modules/services/networking/powerdns.nix40
-rw-r--r--nixos/modules/services/networking/prosody.nix2
-rw-r--r--nixos/modules/services/security/fail2ban.nix4
-rw-r--r--nixos/modules/services/security/usbguard.nix4
-rw-r--r--nixos/modules/services/x11/display-managers/gdm.nix2
-rw-r--r--nixos/modules/services/x11/display-managers/sddm.nix4
8 files changed, 29 insertions, 31 deletions
diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix
index aacdbe2aeed2..86a3f52107d5 100644
--- a/nixos/modules/services/mail/rspamd.nix
+++ b/nixos/modules/services/mail/rspamd.nix
@@ -153,7 +153,7 @@ let
${concatStringsSep "\n" (mapAttrsToList (name: value: let
includeName = if name == "rspamd_proxy" then "proxy" else name;
- tryOverride = if value.extraConfig == "" then "true" else "false";
+ tryOverride = boolToString (value.extraConfig == "");
in ''
worker "${value.type}" {
type = "${value.type}";
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 2680b1cc0d3b..ed05882a6343 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -45,7 +45,7 @@ let
trusted-substituters = ${toString cfg.trustedBinaryCaches}
trusted-public-keys = ${toString cfg.binaryCachePublicKeys}
auto-optimise-store = ${boolToString cfg.autoOptimiseStore}
- require-sigs = ${if cfg.requireSignedBinaryCaches then "true" else "false"}
+ require-sigs = ${boolToString cfg.requireSignedBinaryCaches}
trusted-users = ${toString cfg.trustedUsers}
allowed-users = ${toString cfg.allowedUsers}
${optionalString (!cfg.distributedBuilds) ''
diff --git a/nixos/modules/services/networking/powerdns.nix b/nixos/modules/services/networking/powerdns.nix
index ba05e15389f6..8cae61b83543 100644
--- a/nixos/modules/services/networking/powerdns.nix
+++ b/nixos/modules/services/networking/powerdns.nix
@@ -8,42 +8,40 @@ let
in {
options = {
services.powerdns = {
- enable = mkEnableOption "Powerdns domain name server";
+ enable = mkEnableOption "PowerDNS domain name server";
extraConfig = mkOption {
type = types.lines;
default = "launch=bind";
description = ''
- Extra lines to be added verbatim to pdns.conf.
- Powerdns will chroot to /var/lib/powerdns.
- So any file, powerdns is supposed to be read,
- should be in /var/lib/powerdns and needs to specified
- relative to the chroot.
+ PowerDNS configuration. Refer to
+ <link xlink:href="https://doc.powerdns.com/authoritative/settings.html"/>
+ for details on supported values.
'';
};
};
};
- config = mkIf config.services.powerdns.enable {
+ config = mkIf cfg.enable {
+
+ systemd.packages = [ pkgs.powerdns ];
+
systemd.services.pdns = {
- unitConfig.Documentation = "man:pdns_server(1) man:pdns_control(1)";
- description = "Powerdns name server";
wantedBy = [ "multi-user.target" ];
- after = ["network.target" "mysql.service" "postgresql.service" "openldap.service"];
+ after = [ "network.target" "mysql.service" "postgresql.service" "openldap.service" ];
serviceConfig = {
- Restart="on-failure";
- RestartSec="1";
- StartLimitInterval="0";
- PrivateDevices=true;
- CapabilityBoundingSet="CAP_CHOWN CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT";
- NoNewPrivileges=true;
- ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/powerdns";
- ExecStart = "${pkgs.powerdns}/bin/pdns_server --setuid=nobody --setgid=nogroup --chroot=/var/lib/powerdns --socket-dir=/ --daemon=no --guardian=no --disable-syslog --write-pid=no --config-dir=${configDir}";
- ProtectSystem="full";
- ProtectHome=true;
- RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
+ ExecStart = [ "" "${pkgs.powerdns}/bin/pdns_server --config-dir=${configDir} --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no" ];
};
};
+
+ users.users.pdns = {
+ isSystemUser = true;
+ group = "pdns";
+ description = "PowerDNS";
+ };
+
+ users.groups.pdns = {};
+
};
}
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index a6c1cb0f4797..e7a7aa700be6 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -261,7 +261,7 @@ let
toLua = x:
if builtins.isString x then ''"${x}"''
- else if builtins.isBool x then (if x == true then "true" else "false")
+ else if builtins.isBool x then boolToString x
else if builtins.isInt x then toString x
else if builtins.isList x then ''{ ${lib.concatStringsSep ", " (map (n: toLua n) x) } }''
else throw "Invalid Lua value";
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index 3f84f9c2560c..cf0d72d5c531 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -282,12 +282,12 @@ in
services.fail2ban.jails.DEFAULT = ''
${optionalString cfg.bantime-increment.enable ''
# Bantime incremental
- bantime.increment = ${if cfg.bantime-increment.enable then "true" else "false"}
+ bantime.increment = ${boolToString cfg.bantime-increment.enable}
bantime.maxtime = ${cfg.bantime-increment.maxtime}
bantime.factor = ${cfg.bantime-increment.factor}
bantime.formula = ${cfg.bantime-increment.formula}
bantime.multipliers = ${cfg.bantime-increment.multipliers}
- bantime.overalljails = ${if cfg.bantime-increment.overalljails then "true" else "false"}
+ bantime.overalljails = ${boolToString cfg.bantime-increment.overalljails}
''}
# Miscellaneous options
ignoreip = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}
diff --git a/nixos/modules/services/security/usbguard.nix b/nixos/modules/services/security/usbguard.nix
index 16a90da52314..71fd71a2cab2 100644
--- a/nixos/modules/services/security/usbguard.nix
+++ b/nixos/modules/services/security/usbguard.nix
@@ -19,13 +19,13 @@ let
PresentDevicePolicy=${cfg.presentDevicePolicy}
PresentControllerPolicy=${cfg.presentControllerPolicy}
InsertedDevicePolicy=${cfg.insertedDevicePolicy}
- RestoreControllerDeviceState=${if cfg.restoreControllerDeviceState then "true" else "false"}
+ RestoreControllerDeviceState=${boolToString cfg.restoreControllerDeviceState}
# this does not seem useful for endusers to change
DeviceManagerBackend=uevent
IPCAllowedUsers=${concatStringsSep " " cfg.IPCAllowedUsers}
IPCAllowedGroups=${concatStringsSep " " cfg.IPCAllowedGroups}
IPCAccessControlFiles=/var/lib/usbguard/IPCAccessControl.d/
- DeviceRulesWithPort=${if cfg.deviceRulesWithPort then "true" else "false"}
+ DeviceRulesWithPort=${boolToString cfg.deviceRulesWithPort}
# HACK: that way audit logs still land in the journal
AuditFilePath=/dev/null
'';
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
index eae70a57c781..25b424e485f3 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -264,7 +264,7 @@ in
# presented and there's a little delay.
environment.etc."gdm/custom.conf".text = ''
[daemon]
- WaylandEnable=${if cfg.gdm.wayland then "true" else "false"}
+ WaylandEnable=${boolToString cfg.gdm.wayland}
${optionalString cfg.autoLogin.enable (
if cfg.gdm.autoLogin.delay > 0 then ''
TimedLoginEnable=true
diff --git a/nixos/modules/services/x11/display-managers/sddm.nix b/nixos/modules/services/x11/display-managers/sddm.nix
index e63bb2e44539..4040b903426b 100644
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@@ -55,10 +55,10 @@ let
XauthPath=${pkgs.xorg.xauth}/bin/xauth
DisplayCommand=${Xsetup}
DisplayStopCommand=${Xstop}
- EnableHidpi=${if cfg.enableHidpi then "true" else "false"}
+ EnableHidpi=${boolToString cfg.enableHidpi}
[Wayland]
- EnableHidpi=${if cfg.enableHidpi then "true" else "false"}
+ EnableHidpi=${boolToString cfg.enableHidpi}
SessionDir=${dmcfg.sessionData.desktops}/share/wayland-sessions
${optionalString dmcfg.autoLogin.enable ''
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-17 17:35:03 +0000