From 9a32ba4bc904478a3faaf07af288c2cc79482c3f Mon Sep 17 00:00:00 2001
From: quantenzitrone <general@dev.quantenzitrone.eu>
Date: Sat, 2 May 2026 21:45:37 +0200
Subject: [PATCH] nixos/harmonia: fix for harmonia 3.1.0

this mostly just copies the upstream module at https://github.com/nix-community/harmonia/blob/harmonia-v3.1.0/nix/module.nix
---
 .../modules/services/networking/harmonia.nix  | 50 +++++++++++--------
 1 file changed, 28 insertions(+), 22 deletions(-)

diff --git a/nixos/modules/services/networking/harmonia.nix b/nixos/modules/services/networking/harmonia.nix
index 5a7902f952e7..2eba1bdccad3 100644
--- a/nixos/modules/services/networking/harmonia.nix
+++ b/nixos/modules/services/networking/harmonia.nix
@@ -50,7 +50,7 @@ in
         signKeyPath = lib.mkOption {
           type = lib.types.nullOr lib.types.path;
           default = null;
-          description = "DEPRECATED: Use `services.harmonia-dev.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
+          description = "DEPRECATED: Use `services.harmonia.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
         };
 
         signKeyPaths = lib.mkOption {
@@ -109,31 +109,30 @@ in
         else
           [ ];
 
-      nix.settings.extra-allowed-users = [ "harmonia" ];
-      users.users.harmonia = {
-        isSystemUser = true;
-        group = "harmonia";
+      services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) {
+        bind = "[::]:5000";
+        workers = 4;
+        max_connection_rate = 256;
+        priority = 50;
       };
-      users.groups.harmonia = { };
 
-      services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) (
-        {
-          bind = "[::]:5000";
-          workers = 4;
-          max_connection_rate = 256;
-          priority = 50;
-        }
-        // lib.optionalAttrs daemonCfg.enable {
-          daemon_socket = daemonCfg.socketPath;
-        }
-      );
+      # Socket activation lets the service run with PrivateNetwork; the
+      # inherited fd keeps referring to the host netns.
+      systemd.sockets.harmonia = {
+        description = "harmonia binary cache socket";
+        wantedBy = [ "sockets.target" ];
+        socketConfig.ListenStream =
+          let
+            b = cacheCfg.settings.bind;
+          in
+          if lib.hasPrefix "unix:" b then lib.removePrefix "//" (lib.removePrefix "unix:" b) else b;
+      };
 
       systemd.services.harmonia = {
         description = "harmonia binary cache service";
 
-        requires = if daemonCfg.enable then [ "harmonia-daemon.service" ] else [ "nix-daemon.socket" ];
-        after = [ "network.target" ] ++ lib.optional daemonCfg.enable "harmonia-daemon.service";
-        wantedBy = [ "multi-user.target" ];
+        requires = [ "harmonia.socket" ];
+        after = [ "harmonia.socket" ];
 
         environment = {
           CONFIG_FILE = format.generate "harmonia.toml" cacheCfg.settings;
@@ -150,6 +149,9 @@ in
           ExecStart = lib.getExe cfg.package;
           User = "harmonia";
           Group = "harmonia";
+          DynamicUser = true;
+          Type = "notify";
+          WatchdogSec = 15;
           Restart = "on-failure";
           PrivateUsers = true;
           DeviceAllow = [ "" ];
@@ -174,7 +176,12 @@ in
           ProtectProc = "invisible";
           RestrictNamespaces = true;
           SystemCallArchitectures = "native";
-          PrivateNetwork = false;
+
+          # accept(2) on the inherited fd is exempt from both restrictions.
+          PrivateNetwork = true;
+          RestrictAddressFamilies = [ "AF_UNIX" ];
+          IPAddressDeny = "any";
+
           PrivateTmp = true;
           PrivateDevices = true;
           PrivateMounts = true;
@@ -182,7 +189,6 @@ in
           ProtectSystem = "strict";
           ProtectHome = true;
           LockPersonality = true;
-          RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
           LimitNOFILE = 65536;
         };
       };