diff options
author | Florian Klink <flokli@flokli.de> | 2019-11-25 20:05:25 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2019-11-25 20:05:25 +0100 |
commit | e6aba99c544bee162074b43c8a676bec595cbe09 (patch) | |
tree | cdd50b9091bfec1c2746c2140897ca5e76bcb010 /nixos | |
parent | 01ea5635fc5a0449972e6fad4ba00cac8288e570 (diff) | |
parent | ec16f4fd5b78edcd11f68cb96b41b9a810af315e (diff) | |
download | nixpkgs-e6aba99c544bee162074b43c8a676bec595cbe09.tar nixpkgs-e6aba99c544bee162074b43c8a676bec595cbe09.tar.gz nixpkgs-e6aba99c544bee162074b43c8a676bec595cbe09.tar.bz2 nixpkgs-e6aba99c544bee162074b43c8a676bec595cbe09.tar.lz nixpkgs-e6aba99c544bee162074b43c8a676bec595cbe09.tar.xz nixpkgs-e6aba99c544bee162074b43c8a676bec595cbe09.tar.zst nixpkgs-e6aba99c544bee162074b43c8a676bec595cbe09.zip |
Merge pull request #74084 from WilliButz/systemd-services/use-correct-groups
dont use nogroup for networkd, resolved and timesyncd
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/system/boot/networkd.nix | 2 | ||||
-rw-r--r-- | nixos/modules/system/boot/resolved.nix | 2 | ||||
-rw-r--r-- | nixos/modules/system/boot/timesyncd.nix | 5 | ||||
-rw-r--r-- | nixos/tests/systemd-networkd-wireguard.nix | 11 |
4 files changed, 15 insertions, 5 deletions
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix index f80d5afc55f..226769f1059 100644 --- a/nixos/modules/system/boot/networkd.nix +++ b/nixos/modules/system/boot/networkd.nix @@ -924,6 +924,8 @@ in config = mkIf config.systemd.network.enable { + users.users.systemd-network.group = "systemd-network"; + systemd.additionalUpstreamSystemUnits = [ "systemd-networkd.service" "systemd-networkd-wait-online.service" ]; diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix index 3ea96f8e464..da61c64faf8 100644 --- a/nixos/modules/system/boot/resolved.nix +++ b/nixos/modules/system/boot/resolved.nix @@ -136,6 +136,8 @@ in } ]; + users.users.resolved.group = "systemd-resolve"; + systemd.additionalUpstreamSystemUnits = [ "systemd-resolved.service" ]; diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix index 0b1d0ff6c22..9e2f36ca01f 100644 --- a/nixos/modules/system/boot/timesyncd.nix +++ b/nixos/modules/system/boot/timesyncd.nix @@ -50,7 +50,10 @@ with lib; ${config.services.timesyncd.extraConfig} ''; - users.users.systemd-timesync.uid = config.ids.uids.systemd-timesync; + users.users.systemd-timesync = { + uid = config.ids.uids.systemd-timesync; + group = "systemd-timesync"; + }; users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync; system.activationScripts.systemd-timesyncd-migration = mkIf (versionOlder config.system.stateVersion "19.09") '' diff --git a/nixos/tests/systemd-networkd-wireguard.nix b/nixos/tests/systemd-networkd-wireguard.nix index b83e9c7ce19..be5c0da981d 100644 --- a/nixos/tests/systemd-networkd-wireguard.nix +++ b/nixos/tests/systemd-networkd-wireguard.nix @@ -1,4 +1,4 @@ -let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: { +let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: { imports = [ common/user-account.nix ]; systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug"; networking.useNetworkd = true; @@ -7,13 +7,16 @@ let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ... virtualisation.vlans = [ 1 ]; environment.systemPackages = with pkgs; [ wireguard-tools ]; boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ]; + systemd.tmpfiles.rules = [ + "f /run/wg_priv 0640 root systemd-network - ${privk}" + ]; systemd.network = { enable = true; netdevs = { "90-wg0" = { netdevConfig = { Kind = "wireguard"; Name = "wg0"; }; wireguardConfig = { - PrivateKeyFile = privkpath ; + PrivateKeyFile = "/run/wg_priv"; ListenPort = 51820; FwMark = 42; }; @@ -53,7 +56,7 @@ in import ./make-test-python.nix ({pkgs, ... }: { nodes = { node1 = { pkgs, ... }@attrs: let localConf = { - privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00="; + privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00="; pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE="; nodeId = "1"; peerId = "2"; @@ -62,7 +65,7 @@ in import ./make-test-python.nix ({pkgs, ... }: { node2 = { pkgs, ... }@attrs: let localConf = { - privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k="; + privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k="; pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g="; nodeId = "2"; peerId = "1"; |