gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/harmonia: fix for harmonia 3.1.0

Browse Source 
this mostly just copies the upstream module at https://github.com/nix-community/harmonia/blob/harmonia-v3.1.0/nix/module.nix
This commit is contained in:
quantenzitrone
2026-05-02 21:45:37 +02:00
parent 69b27b9443
commit 9a32ba4bc9
1 changed files with 28 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/networking/harmonia.nix
+28 -22
View File
@@ -50,7 +50,7 @@ in
signKeyPath = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = "DEPRECATED: Use `services.harmonia-dev.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
description = "DEPRECATED: Use `services.harmonia.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
};
signKeyPaths = lib.mkOption {
@@ -109,31 +109,30 @@ in
else
[ ];
nix.settings.extra-allowed-users = [ "harmonia" ];
users.users.harmonia = {
isSystemUser = true;
group = "harmonia";
services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) {
bind = "[::]:5000";
workers = 4;
max_connection_rate = 256;
priority = 50;
};
users.groups.harmonia = { };
services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) (
{
bind = "[::]:5000";
workers = 4;
max_connection_rate = 256;
priority = 50;
}
// lib.optionalAttrs daemonCfg.enable {
daemon_socket = daemonCfg.socketPath;
}
);
# Socket activation lets the service run with PrivateNetwork; the
# inherited fd keeps referring to the host netns.
systemd.sockets.harmonia = {
description = "harmonia binary cache socket";
wantedBy = [ "sockets.target" ];
socketConfig.ListenStream =
let
b = cacheCfg.settings.bind;
in
if lib.hasPrefix "unix:" b then lib.removePrefix "//" (lib.removePrefix "unix:" b) else b;
};
systemd.services.harmonia = {
description = "harmonia binary cache service";
requires = if daemonCfg.enable then [ "harmonia-daemon.service" ] else [ "nix-daemon.socket" ];
after = [ "network.target" ] ++ lib.optional daemonCfg.enable "harmonia-daemon.service";
wantedBy = [ "multi-user.target" ];
requires = [ "harmonia.socket" ];
after = [ "harmonia.socket" ];
environment = {
CONFIG_FILE = format.generate "harmonia.toml" cacheCfg.settings;
@@ -150,6 +149,9 @@ in
ExecStart = lib.getExe cfg.package;
User = "harmonia";
Group = "harmonia";
DynamicUser = true;
Type = "notify";
WatchdogSec = 15;
Restart = "on-failure";
PrivateUsers = true;
DeviceAllow = [ "" ];
@@ -174,7 +176,12 @@ in
ProtectProc = "invisible";
RestrictNamespaces = true;
SystemCallArchitectures = "native";
PrivateNetwork = false;
# accept(2) on the inherited fd is exempt from both restrictions.
PrivateNetwork = true;
RestrictAddressFamilies = [ "AF_UNIX" ];
IPAddressDeny = "any";
PrivateTmp = true;
PrivateDevices = true;
PrivateMounts = true;
@@ -182,7 +189,6 @@ in
ProtectSystem = "strict";
ProtectHome = true;
LockPersonality = true;
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
LimitNOFILE = 65536;
};
};