diff options
| author | arcnmx <arcnmx@users.noreply.github.com> | 2021-11-06 08:31:58 -0700 |
|---|---|---|
| committer | arcnmx <arcnmx@users.noreply.github.com> | 2021-11-06 08:50:39 -0700 |
| commit | 7deb5247a5da4f468a0abe464275f6c913c5f33f (patch) | |
| tree | 67526621ca55eb73632325449e96dd904ca71524 /nixos/modules/services/networking/ddclient.nix | |
| parent | 0d5b4445e33b1cd666b107bbdf5920884bbaeb1a (diff) | |
| download | nixpkgs-7deb5247a5da4f468a0abe464275f6c913c5f33f.tar nixpkgs-7deb5247a5da4f468a0abe464275f6c913c5f33f.tar.gz nixpkgs-7deb5247a5da4f468a0abe464275f6c913c5f33f.tar.bz2 nixpkgs-7deb5247a5da4f468a0abe464275f6c913c5f33f.tar.lz nixpkgs-7deb5247a5da4f468a0abe464275f6c913c5f33f.tar.xz nixpkgs-7deb5247a5da4f468a0abe464275f6c913c5f33f.tar.zst nixpkgs-7deb5247a5da4f468a0abe464275f6c913c5f33f.zip | |
nixos/ddclient: fix privs when loading password
Diffstat (limited to 'nixos/modules/services/networking/ddclient.nix')
| -rw-r--r-- | nixos/modules/services/networking/ddclient.nix | 21 |
1 files changed, 12 insertions, 9 deletions
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix index 833b0cbcdcf..5fb8d79fe56 100644 --- a/nixos/modules/services/networking/ddclient.nix +++ b/nixos/modules/services/networking/ddclient.nix @@ -28,6 +28,16 @@ let ''; configFile = if (cfg.configFile != null) then cfg.configFile else configFile'; + preStart = '' + install ${configFile} /run/${RuntimeDirectory}/ddclient.conf + ${lib.optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then '' + password=$(head -n 1 ${cfg.passwordFile}) + sed -i "s/^password=$/password=$password/" /run/${RuntimeDirectory}/ddclient.conf + '' else '' + sed -i '/^password=$/d' /run/${RuntimeDirectory}/ddclient.conf + '')} + ''; + in with lib; @@ -195,20 +205,13 @@ with lib; serviceConfig = { DynamicUser = true; + RuntimeDirectoryMode = "0700"; inherit RuntimeDirectory; inherit StateDirectory; Type = "oneshot"; + ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}"; ExecStart = "${lib.getBin pkgs.ddclient}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf"; }; - preStart = '' - install -m 600 ${configFile} /run/${RuntimeDirectory}/ddclient.conf - ${optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then '' - password=$(head -n 1 ${cfg.passwordFile}) - sed -i "s/^password=$/password=$password/" /run/${RuntimeDirectory}/ddclient.conf - '' else '' - sed -i '/^password=$/d' /run/${RuntimeDirectory}/ddclient.conf - '')} - ''; }; systemd.timers.ddclient = { |