From cb1c5dbb15f1c2f0802007c7ac661d371d00babf Mon Sep 17 00:00:00 2001 From: Roland Synnestvedt Date: Sat, 26 Mar 2022 17:53:26 -0700 Subject: [PATCH 1/4] nixos/unifi-video: convert int to string in default command --- nixos/modules/services/video/unifi-video.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/video/unifi-video.nix b/nixos/modules/services/video/unifi-video.nix index 43208a9fe4cf..366a7111fde4 100644 --- a/nixos/modules/services/video/unifi-video.nix +++ b/nixos/modules/services/video/unifi-video.nix @@ -16,7 +16,7 @@ let -pidfile ${cfg.pidFile} \ -procname unifi-video \ -Djava.security.egd=file:/dev/./urandom \ - -Xmx${cfg.maximumJavaHeapSize}M \ + -Xmx${toString cfg.maximumJavaHeapSize}M \ -Xss512K \ -XX:+UseG1GC \ -XX:+UseStringDeduplication \ From 95a3f6ad266c1a340630bbdb4787e202bf9bd883 Mon Sep 17 00:00:00 2001 From: Roland Synnestvedt Date: Sat, 26 Mar 2022 17:59:54 -0700 Subject: [PATCH 2/4] nixos/unifi-video: rename openPorts to openFirewall --- nixos/modules/services/video/unifi-video.nix | 24 +++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/nixos/modules/services/video/unifi-video.nix b/nixos/modules/services/video/unifi-video.nix index 366a7111fde4..53acb9d79b91 100644 --- a/nixos/modules/services/video/unifi-video.nix +++ b/nixos/modules/services/video/unifi-video.nix @@ -145,13 +145,6 @@ in ''; }; - openPorts = mkOption { - type = types.bool; - default = true; - description = '' - Whether or not to open the required ports on the firewall. - ''; - }; maximumJavaHeapSize = mkOption { type = types.nullOr types.int; @@ -168,6 +161,13 @@ in defaultText = literalExpression ''"''${config.${opt.dataDir}}/unifi-video.pid"''; description = "Location of unifi-video pid file."; }; + openFirewall = mkOption { + type = types.bool; + default = true; + description = '' + Whether or not to open the required ports on the firewall. + ''; + }; }; @@ -182,7 +182,7 @@ config = mkIf cfg.enable { groups.unifi-video = {}; }; - networking.firewall = mkIf cfg.openPorts { + networking.firewall = mkIf cfg.openFirewall { # https://help.ui.com/hc/en-us/articles/217875218-UniFi-Video-Ports-Used allowedTCPPorts = [ 7080 # HTTP portal @@ -261,7 +261,9 @@ config = mkIf cfg.enable { }; - meta = { - maintainers = with lib.maintainers; [ rsynnest ]; - }; + imports = [ + (mkRenamedOptionModule [ "services" "unifi-video" "openPorts" ] [ "services" "unifi-video" "openFirewall" ]) + ]; + + meta.maintainers = with lib.maintainers; [ rsynnest ]; } From 60e62c36df25e882d73881a627b8cd6816340bee Mon Sep 17 00:00:00 2001 From: Roland Synnestvedt Date: Sun, 27 Mar 2022 13:39:19 -0700 Subject: [PATCH 3/4] nixos/unifi-video: clean up indentation and formatting --- nixos/modules/services/video/unifi-video.nix | 138 +++++++++---------- 1 file changed, 68 insertions(+), 70 deletions(-) diff --git a/nixos/modules/services/video/unifi-video.nix b/nixos/modules/services/video/unifi-video.nix index 53acb9d79b91..7456736c8b21 100644 --- a/nixos/modules/services/video/unifi-video.nix +++ b/nixos/modules/services/video/unifi-video.nix @@ -91,76 +91,61 @@ let stateDir = "/var/lib/unifi-video"; in - { +{ - options.services.unifi-video = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Whether or not to enable the unifi-video service. - ''; - }; + options.services.unifi-video = { - jrePackage = mkOption { - type = types.package; - default = pkgs.jre8; - defaultText = literalExpression "pkgs.jre8"; - description = '' - The JRE package to use. Check the release notes to ensure it is supported. - ''; - }; + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether or not to enable the unifi-video service. + ''; + }; - unifiVideoPackage = mkOption { - type = types.package; - default = pkgs.unifi-video; - defaultText = literalExpression "pkgs.unifi-video"; - description = '' - The unifi-video package to use. - ''; - }; + jrePackage = mkOption { + type = types.package; + default = pkgs.jre8; + defaultText = literalExpression "pkgs.jre8"; + description = '' + The JRE package to use. Check the release notes to ensure it is supported. + ''; + }; - mongodbPackage = mkOption { - type = types.package; - default = pkgs.mongodb-4_0; - defaultText = literalExpression "pkgs.mongodb"; - description = '' - The mongodb package to use. - ''; - }; + unifiVideoPackage = mkOption { + type = types.package; + default = pkgs.unifi-video; + defaultText = literalExpression "pkgs.unifi-video"; + description = '' + The unifi-video package to use. + ''; + }; - logDir = mkOption { - type = types.str; - default = "${stateDir}/logs"; - description = '' - Where to store the logs. - ''; - }; + mongodbPackage = mkOption { + type = types.package; + default = pkgs.mongodb-4_0; + defaultText = literalExpression "pkgs.mongodb"; + description = '' + The mongodb package to use. + ''; + }; - dataDir = mkOption { - type = types.str; - default = "${stateDir}/data"; - description = '' - Where to store the database and other data. - ''; - }; + logDir = mkOption { + type = types.str; + default = "${stateDir}/logs"; + description = '' + Where to store the logs. + ''; + }; + dataDir = mkOption { + type = types.str; + default = "${stateDir}/data"; + description = '' + Where to store the database and other data. + ''; + }; - maximumJavaHeapSize = mkOption { - type = types.nullOr types.int; - default = 1024; - example = 4096; - description = '' - Set the maximimum heap size for the JVM in MB. - ''; - }; - - pidFile = mkOption { - type = types.path; - default = "${cfg.dataDir}/unifi-video.pid"; - defaultText = literalExpression ''"''${config.${opt.dataDir}}/unifi-video.pid"''; - description = "Location of unifi-video pid file."; - }; openFirewall = mkOption { type = types.bool; default = true; @@ -169,18 +154,33 @@ in ''; }; -}; + maximumJavaHeapSize = mkOption { + type = types.nullOr types.int; + default = 1024; + example = 4096; + description = '' + Set the maximimum heap size for the JVM in MB. + ''; + }; -config = mkIf cfg.enable { - users = { - users.unifi-video = { + pidFile = mkOption { + type = types.path; + default = "${cfg.dataDir}/unifi-video.pid"; + defaultText = literalExpression ''"''${config.${opt.dataDir}}/unifi-video.pid"''; + description = "Location of unifi-video pid file."; + }; + + }; + + config = mkIf cfg.enable { + + users.users.unifi-video = { description = "UniFi Video controller daemon user"; home = stateDir; group = "unifi-video"; isSystemUser = true; }; - groups.unifi-video = {}; - }; + users.groups.unifi-video = {}; networking.firewall = mkIf cfg.openFirewall { # https://help.ui.com/hc/en-us/articles/217875218-UniFi-Video-Ports-Used @@ -237,7 +237,6 @@ config = mkIf cfg.enable { "L+ '${stateDir}/conf/server.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/server.xml" "L+ '${stateDir}/conf/tomcat-users.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/tomcat-users.xml" "L+ '${stateDir}/conf/web.xml' 0700 unifi-video unifi-video - ${pkgs.unifi-video}/lib/unifi-video/conf/web.xml" - ]; systemd.services.unifi-video = { @@ -258,7 +257,6 @@ config = mkIf cfg.enable { WorkingDirectory = "${stateDir}"; }; }; - }; imports = [ From 33b04f2a80aa6a4556a0cbc102f82c2b8d788fe0 Mon Sep 17 00:00:00 2001 From: Roland Synnestvedt Date: Mon, 28 Mar 2022 09:20:53 -0700 Subject: [PATCH 4/4] nixos/unifi-video: add deprecation warning for openFirewall --- .../doc/manual/from_md/release-notes/rl-2205.section.xml | 9 +++++++++ nixos/doc/manual/release-notes/rl-2205.section.md | 3 +++ nixos/modules/services/video/unifi-video.nix | 4 ++++ 3 files changed, 16 insertions(+) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index 66f2ac7ae261..bc37478ddbbc 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -1210,6 +1210,15 @@ using this default will print a warning when rebuilt. + + + The services.unifi-video.openPorts option + default value of true is now deprecated and + will be changed to false in 22.11. + Configurations using this default will print a warning when + rebuilt. + + security.acme certificates will now diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index 018939939557..288f6c045f5d 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -454,6 +454,9 @@ In addition to numerous new and upgraded packages, this release has the followin - The `services.unifi.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11. Configurations using this default will print a warning when rebuilt. +- The `services.unifi-video.openPorts` option default value of `true` is now deprecated and will be changed to `false` in 22.11. + Configurations using this default will print a warning when rebuilt. + - `security.acme` certificates will now correctly check for CA revokation before reaching their minimum age. diff --git a/nixos/modules/services/video/unifi-video.nix b/nixos/modules/services/video/unifi-video.nix index 7456736c8b21..11d9fe305470 100644 --- a/nixos/modules/services/video/unifi-video.nix +++ b/nixos/modules/services/video/unifi-video.nix @@ -174,6 +174,10 @@ in config = mkIf cfg.enable { + warnings = optional + (options.services.unifi-video.openFirewall.highestPrio >= (mkOptionDefault null).priority) + "The current services.unifi-video.openFirewall = true default is deprecated and will change to false in 22.11. Set it explicitly to silence this warning."; + users.users.unifi-video = { description = "UniFi Video controller daemon user"; home = stateDir;