gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ghostunnel: simplify service using systemd.mainExecStart

Browse Source
This commit is contained in:
Robert Hensing
2025-12-11 11:01:24 +01:00
parent 7b4d26bf86
commit b1caac95aa
2 changed files with 51 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/gh/ghostunnel/package.nix
+1 -5
View File
@@ -5,8 +5,6 @@
lib,
nixosTests,
ghostunnel,
writeScript,
runtimeShell,
}:
buildGoModule rec {
@@ -37,9 +35,7 @@ buildGoModule rec {
passthru.services.default = {
imports = [
(lib.modules.importApply ./service.nix {
inherit writeScript runtimeShell;
})
(lib.modules.importApply ./service.nix { })
];
ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage
};
pkgs/by-name/gh/ghostunnel/service.nix
+50 -56
View File
@@ -1,5 +1,5 @@
# Non-module dependencies (`importApply`)
{ writeScript, runtimeShell }:
{ }:
# Service module
{
@@ -185,62 +185,56 @@ in
# TODO assertions
process = {
argv =
# Use a shell if credentials need to be pulled from the environment.
optional
(builtins.any (v: v != null) [
cfg.keystore
cfg.cert
cfg.key
cfg.cacert
])
(
writeScript "load-credentials" ''
#!${runtimeShell}
exec $@ ${
concatStringsSep " " (
optional (cfg.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"
++ optional (cfg.cert != null) "--cert=$CREDENTIALS_DIRECTORY/cert"
++ optional (cfg.key != null) "--key=$CREDENTIALS_DIRECTORY/key"
++ optional (cfg.cacert != null) "--cacert=$CREDENTIALS_DIRECTORY/cacert"
)
}
''
)
++ [
(getExe cfg.package)
"server"
"--listen"
cfg.listen
"--target"
cfg.target
]
++ optional cfg.allowAll "--allow-all"
++ map (v: "--allow-cn=${v}") cfg.allowCN
++ map (v: "--allow-ou=${v}") cfg.allowOU
++ map (v: "--allow-dns=${v}") cfg.allowDNS
++ map (v: "--allow-uri=${v}") cfg.allowURI
++ optional cfg.disableAuthentication "--disable-authentication"
++ optional cfg.unsafeTarget "--unsafe-target"
++ cfg.extraArguments;
argv = [
(getExe cfg.package)
"server"
"--listen"
cfg.listen
"--target"
cfg.target
]
++ optional cfg.allowAll "--allow-all"
++ map (v: "--allow-cn=${v}") cfg.allowCN
++ map (v: "--allow-ou=${v}") cfg.allowOU
++ map (v: "--allow-dns=${v}") cfg.allowDNS
++ map (v: "--allow-uri=${v}") cfg.allowURI
++ optional cfg.disableAuthentication "--disable-authentication"
++ optional cfg.unsafeTarget "--unsafe-target"
++ cfg.extraArguments;
};
}
// lib.optionalAttrs (options ? systemd) {
# refine the service
systemd.service = {
after = [ "network.target" ];
wants = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Restart = "always";
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
DynamicUser = true;
LoadCredential =
optional (cfg.keystore != null) "keystore:${cfg.keystore}"
++ optional (cfg.cert != null) "cert:${cfg.cert}"
++ optional (cfg.key != null) "key:${cfg.key}"
++ optional (cfg.cacert != null) "cacert:${cfg.cacert}";
# Refine the service for systemd
// lib.optionalAttrs (options ? systemd) (
let
# Build credential flags with systemd variable substitution
credentialFlags = concatStringsSep " " (
optional (cfg.keystore != null) "--keystore=\${CREDENTIALS_DIRECTORY}/keystore"
++ optional (cfg.cert != null) "--cert=\${CREDENTIALS_DIRECTORY}/cert"
++ optional (cfg.key != null) "--key=\${CREDENTIALS_DIRECTORY}/key"
++ optional (cfg.cacert != null) "--cacert=\${CREDENTIALS_DIRECTORY}/cacert"
);
in
{
# Use mainExecStart to add credential flags with systemd variable substitution
systemd.mainExecStart =
config.systemd.lib.escapeSystemdExecArgs config.process.argv
+ lib.optionalString (credentialFlags != "") " ${credentialFlags}";
systemd.service = {
after = [ "network.target" ];
wants = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Restart = "always";
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
DynamicUser = true;
LoadCredential =
optional (cfg.keystore != null) "keystore:${cfg.keystore}"
++ optional (cfg.cert != null) "cert:${cfg.cert}"
++ optional (cfg.key != null) "key:${cfg.key}"
++ optional (cfg.cacert != null) "cacert:${cfg.cacert}";
};
};
};
};
}
);
}