From 167d6634f8a4bad4e6a494cb47052d8dcaa29cac Mon Sep 17 00:00:00 2001 From: Slava Date: Sat, 28 Dec 2024 14:20:43 +0500 Subject: [PATCH] services.xray: pass the settings file with systemd loadCredential It enables passing a sops-nix secret as a `settingsFile` @see https://github.com/Mic92/sops-nix/issues/198. By default sops-nix secrets are accessible by only root. We can change owner to another user, but the xray service is defined with `dynamicUser=true`, which means, there is no user in the compile time. Systemd `loadCredential` passes the secret file to the service, which is exactly what we need here. --- nixos/modules/services/networking/xray.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/xray.nix b/nixos/modules/services/networking/xray.nix index 40a154d8d030..c7cbee44b81e 100644 --- a/nixos/modules/services/networking/xray.nix +++ b/nixos/modules/services/networking/xray.nix @@ -80,9 +80,12 @@ with lib; description = "xray Daemon"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; + script = '' + exec "${cfg.package}/bin/xray" -config "$CREDENTIALS_DIRECTORY/config.json" + ''; serviceConfig = { DynamicUser = true; - ExecStart = "${cfg.package}/bin/xray -config ${settingsFile}"; + LoadCredential = "config.json:${settingsFile}"; CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; NoNewPrivileges = true;