From 99454b6f77a9b8f47b3fcb7c21243658ee986cbc Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 7 Jun 2021 09:29:21 +0200 Subject: [PATCH 1/5] nixos/geoipupdate: Fix config filename copy-paste fail --- nixos/modules/services/misc/geoipupdate.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/misc/geoipupdate.nix b/nixos/modules/services/misc/geoipupdate.nix index 5d87be928d98..5f843979e984 100644 --- a/nixos/modules/services/misc/geoipupdate.nix +++ b/nixos/modules/services/misc/geoipupdate.nix @@ -119,7 +119,7 @@ in }; }; - geoipupdateConf = pkgs.writeText "discourse.conf" (geoipupdateKeyValue cfg.settings); + geoipupdateConf = pkgs.writeText "geoipupdate.conf" (geoipupdateKeyValue cfg.settings); script = '' mkdir -p "${cfg.settings.DatabaseDirectory}" From 7cf55d1f4edba3e907dcff5958be4dc0bda0897d Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 7 Jun 2021 09:44:05 +0200 Subject: [PATCH 2/5] nixos/geoipupdate: Add myself to maintainers --- nixos/modules/services/misc/geoipupdate.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/misc/geoipupdate.nix b/nixos/modules/services/misc/geoipupdate.nix index 5f843979e984..836802e3830a 100644 --- a/nixos/modules/services/misc/geoipupdate.nix +++ b/nixos/modules/services/misc/geoipupdate.nix @@ -142,4 +142,6 @@ in }; }; }; + + meta.maintainers = [ lib.maintainers.talyz ]; } From ba4d2bd03c0b30c888876f8b80bb5e42747d09de Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 7 Jun 2021 13:01:49 +0200 Subject: [PATCH 3/5] nixos/geoipupdate: Create database directory in a separate unit The database directory needs to be created before the geoipupdate.service unit is activated; otherwise, systemd will not be able to set up the mount namespacing to grant the service read-write access. --- nixos/modules/services/misc/geoipupdate.nix | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/misc/geoipupdate.nix b/nixos/modules/services/misc/geoipupdate.nix index 836802e3830a..3cf8e5e1099f 100644 --- a/nixos/modules/services/misc/geoipupdate.nix +++ b/nixos/modules/services/misc/geoipupdate.nix @@ -99,9 +99,22 @@ in LockFile = "/run/geoipupdate/.lock"; }; + systemd.services.geoipupdate-create-db-dir = { + serviceConfig.Type = "oneshot"; + script = '' + mkdir -p ${cfg.settings.DatabaseDirectory} + chmod 0755 ${cfg.settings.DatabaseDirectory} + ''; + }; + systemd.services.geoipupdate = { description = "GeoIP Updater"; - after = [ "network-online.target" "nss-lookup.target" ]; + requires = [ "geoipupdate-create-db-dir.service" ]; + after = [ + "geoipupdate-create-db-dir.service" + "network-online.target" + "nss-lookup.target" + ]; wants = [ "network-online.target" ]; startAt = cfg.interval; serviceConfig = { @@ -122,8 +135,6 @@ in geoipupdateConf = pkgs.writeText "geoipupdate.conf" (geoipupdateKeyValue cfg.settings); script = '' - mkdir -p "${cfg.settings.DatabaseDirectory}" - chmod 755 "${cfg.settings.DatabaseDirectory}" chown geoip "${cfg.settings.DatabaseDirectory}" cp ${geoipupdateConf} /run/geoipupdate/GeoIP.conf From 41c82cd57033ce8122899b8cf96dc824c7ce7e8d Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 7 Jun 2021 13:08:59 +0200 Subject: [PATCH 4/5] nixos/geoipupdate: Run the service right away one time We don't want to have to wait for the timer to expire for the updater to make its first run. This adds a timer unit which triggers the geoipupdate.service unit immediately, but only runs if the configured DatabaseDirectory doesn't exist yet. --- nixos/modules/services/misc/geoipupdate.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/nixos/modules/services/misc/geoipupdate.nix b/nixos/modules/services/misc/geoipupdate.nix index 3cf8e5e1099f..15d6051fce56 100644 --- a/nixos/modules/services/misc/geoipupdate.nix +++ b/nixos/modules/services/misc/geoipupdate.nix @@ -152,6 +152,15 @@ in RuntimeDirectoryMode = 0700; }; }; + + systemd.timers.geoipupdate-initial-run = { + wantedBy = [ "timers.target" ]; + unitConfig.ConditionPathExists = "!${cfg.settings.DatabaseDirectory}"; + timerConfig = { + Unit = "geoipupdate.service"; + OnActiveSec = 0; + }; + }; }; meta.maintainers = [ lib.maintainers.talyz ]; From 7cc39b13b00dd8ce5eebc5a1cb53e3de22dc9b99 Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 7 Jun 2021 13:14:44 +0200 Subject: [PATCH 5/5] nixos/geoipupdate: Add stricter service security --- nixos/modules/services/misc/geoipupdate.nix | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/nixos/modules/services/misc/geoipupdate.nix b/nixos/modules/services/misc/geoipupdate.nix index 15d6051fce56..3211d4d88e4d 100644 --- a/nixos/modules/services/misc/geoipupdate.nix +++ b/nixos/modules/services/misc/geoipupdate.nix @@ -150,6 +150,26 @@ in ReadWritePaths = cfg.settings.DatabaseDirectory; RuntimeDirectory = "geoipupdate"; RuntimeDirectoryMode = 0700; + CapabilityBoundingSet = ""; + PrivateDevices = true; + PrivateMounts = true; + PrivateUsers = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProcSubset = "pid"; + SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + RestrictRealtime = true; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + LockPersonality = true; + SystemCallArchitectures = "native"; }; };