tjh.dev
nixos: uptimed - rewrite and harden a bit (#7220)
This is mostly @thoughtpolice's work, but I cleaned it up a bit.
+29
-40
nixos/modules/services/system/uptimed.nix
+29
-40
nixos/modules/services/system/uptimed.nix
···
1
-
{pkgs, config, lib, ...}:
2
3
let
4
-
5
-
inherit (lib) mkOption mkIf singleton;
6
-
7
-
inherit (pkgs) uptimed;
8
-
9
stateDir = "/var/spool/uptimed";
10
-
11
-
uptimedUser = "uptimed";
12
-
13
in
14
-
15
{
16
-
17
-
###### interface
18
-
19
options = {
20
-
21
services.uptimed = {
22
-
23
enable = mkOption {
24
default = false;
25
description = ''
26
-
Uptimed allows you to track your highest uptimes.
27
'';
28
};
29
-
30
};
31
-
32
};
33
34
35
-
###### implementation
36
37
-
config = mkIf config.services.uptimed.enable {
38
-
39
-
environment.systemPackages = [ uptimed ];
40
-
41
-
users.extraUsers = singleton
42
-
{ name = uptimedUser;
43
-
uid = config.ids.uids.uptimed;
44
-
description = "Uptimed daemon user";
45
-
home = stateDir;
46
};
47
48
-
systemd.services.uptimed = {
49
-
description = "Uptimed daemon";
50
-
wantedBy = [ "multi-user.target" ];
51
-
52
preStart = ''
53
-
mkdir -m 0755 -p ${stateDir}
54
-
chown ${uptimedUser} ${stateDir}
55
-
56
if ! test -f ${stateDir}/bootid ; then
57
-
${uptimed}/sbin/uptimed -b
58
fi
59
'';
60
-
61
-
script = "${uptimed}/sbin/uptimed";
62
};
63
-
64
};
65
-
66
}
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
with lib;
4
5
let
6
+
cfg = config.services.uptimed;
7
stateDir = "/var/spool/uptimed";
8
in
9
{
10
options = {
11
services.uptimed = {
12
enable = mkOption {
13
default = false;
14
description = ''
15
+
Enable <literal>uptimed</literal>, allowing you to track
16
+
your highest uptimes.
17
'';
18
};
19
};
20
};
21
22
+
config = mkIf cfg.enable {
23
+
users.extraUsers.uptimed = {
24
+
description = "Uptimed daemon user";
25
+
home = stateDir;
26
+
createHome = true;
27
+
uid = config.ids.uids.uptimed;
28
+
};
29
30
+
systemd.services.uptimed = {
31
+
unitConfig.Documentation = "man:uptimed(8) man:uprecords(1)";
32
+
description = "uptimed service";
33
+
wantedBy = [ "multi-user.target" ];
34
35
+
serviceConfig = {
36
+
Restart = "on-failure";
37
+
User = "uptimed";
38
+
Nice = 19;
39
+
IOSchedulingClass = "idle";
40
+
PrivateTmp = "yes";
41
+
PrivateNetwork = "yes";
42
+
NoNewPrivileges = "yes";
43
+
ReadWriteDirectories = stateDir;
44
+
InaccessibleDirectories = "/home";
45
+
ExecStart = "${pkgs.uptimed}/sbin/uptimed -f -p ${stateDir}/pid";
46
};
47
48
preStart = ''
49
if ! test -f ${stateDir}/bootid ; then
50
+
${pkgs.uptimed}/sbin/uptimed -b
51
fi
52
'';
53
};
54
};
55
}