82 lines
2.0 KiB
Nix
82 lines
2.0 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.vnstat;
|
|
settingsFormat = pkgs.formats.keyValue { };
|
|
in
|
|
{
|
|
options.services.vnstat = {
|
|
enable = lib.mkEnableOption "update of network usage statistics via vnstatd";
|
|
package = lib.mkPackageOption pkgs "vnstat" { };
|
|
settings = lib.mkOption {
|
|
type = lib.types.submodule { freeformType = settingsFormat.type; };
|
|
default = { };
|
|
description = ''
|
|
Configuration for vnstat. Refer to
|
|
[https://humdi.net/vnstat/man/vnstat.conf.html]
|
|
or {manpage}`vnstat.conf(5)` for more information.
|
|
'';
|
|
example = {
|
|
AlwaysAddNewInterfaces = 1;
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
environment.systemPackages = [ cfg.package ];
|
|
|
|
environment.etc."vnstat.conf".source = settingsFormat.generate "vnstat.conf" cfg.settings;
|
|
|
|
users = {
|
|
groups.vnstatd = { };
|
|
|
|
users.vnstatd = {
|
|
isSystemUser = true;
|
|
group = "vnstatd";
|
|
description = "vnstat daemon user";
|
|
};
|
|
};
|
|
|
|
systemd.services.vnstat = {
|
|
description = "vnStat network traffic monitor";
|
|
path = [ pkgs.coreutils ];
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
documentation = [
|
|
"man:vnstatd(1)"
|
|
"man:vnstat(1)"
|
|
"man:vnstat.conf(5)"
|
|
];
|
|
serviceConfig = {
|
|
ExecStart = "${cfg.package}/bin/vnstatd -n";
|
|
ExecReload = "${pkgs.procps}/bin/kill -HUP $MAINPID";
|
|
|
|
# Hardening (from upstream example service)
|
|
ProtectSystem = "strict";
|
|
StateDirectory = "vnstat";
|
|
PrivateDevices = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectKernelModules = true;
|
|
PrivateTmp = true;
|
|
MemoryDenyWriteExecute = true;
|
|
RestrictRealtime = true;
|
|
RestrictNamespaces = true;
|
|
|
|
User = "vnstatd";
|
|
Group = "vnstatd";
|
|
};
|
|
};
|
|
};
|
|
|
|
meta = {
|
|
maintainers = with lib.maintainers; [ hmenke ];
|
|
};
|
|
}
|