diff options
author | Pascal Bach <pascal.bach@nextrem.ch> | 2021-10-29 00:00:10 +0200 |
---|---|---|
committer | Kerstin <kerstin@erictapen.name> | 2021-11-05 12:20:40 +0100 |
commit | 0f60c45e9c577124dc371e442bdf5d91fc52d9dd (patch) | |
tree | 714879f7a360f460f3d091d8bae984f2963619f2 /nixos/modules/services/networking/unifi.nix | |
parent | 79ea7aa9f9cbb493e335d71a404d57488735df8d (diff) |
nixos/unifi: refactor mountpoints
Use service internal bind mounts instead of global ones. This also moves the logs to /var/log/unifi on the host and the run directory to /run/unifi. Closes #61424
Diffstat (limited to 'nixos/modules/services/networking/unifi.nix')
-rw-r--r-- | nixos/modules/services/networking/unifi.nix | 80 |
1 files changed, 26 insertions, 54 deletions
diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix index caf89c84397f9..53ad4df477fcc 100644 --- a/nixos/modules/services/networking/unifi.nix +++ b/nixos/modules/services/networking/unifi.nix @@ -9,25 +9,6 @@ let ${optionalString (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m"} \ -jar ${stateDir}/lib/ace.jar ''; - mountPoints = [ - { - what = "${cfg.unifiPackage}/dl"; - where = "${stateDir}/dl"; - } - { - what = "${cfg.unifiPackage}/lib"; - where = "${stateDir}/lib"; - } - { - what = "${cfg.mongodbPackage}/bin"; - where = "${stateDir}/bin"; - } - { - what = "${cfg.dataDir}"; - where = "${stateDir}/data"; - } - ]; - systemdMountPoints = map (m: "${utils.escapeSystemdPath m.where}.mount") mountPoints; in { @@ -68,16 +49,6 @@ in ''; }; - services.unifi.dataDir = mkOption { - type = types.str; - default = "${stateDir}/data"; - description = '' - Where to store the database and other data. - - This directory will be bind-mounted to ${stateDir}/data as part of the service startup. - ''; - }; - services.unifi.openPorts = mkOption { type = types.bool; default = true; @@ -136,32 +107,11 @@ in ]; }; - # We must create the binary directories as bind mounts instead of symlinks - # This is because the controller resolves all symlinks to absolute paths - # to be used as the working directory. - systemd.mounts = map ({ what, where }: { - bindsTo = [ "unifi.service" ]; - partOf = [ "unifi.service" ]; - unitConfig.RequiresMountsFor = stateDir; - options = "bind"; - what = what; - where = where; - }) mountPoints; - - systemd.tmpfiles.rules = [ - "d '${stateDir}' 0700 unifi - - -" - "d '${stateDir}/data' 0700 unifi - - -" - "d '${stateDir}/webapps' 0700 unifi - - -" - "L+ '${stateDir}/webapps/ROOT' - - - - ${cfg.unifiPackage}/webapps/ROOT" - ]; - systemd.services.unifi = { description = "UniFi controller daemon"; wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ] ++ systemdMountPoints; - partOf = systemdMountPoints; - bindsTo = systemdMountPoints; - unitConfig.RequiresMountsFor = stateDir; + after = [ "network.target" ]; + # This a HACK to fix missing dependencies of dynamic libs extracted from jars environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib"; # Make sure package upgrades trigger a service restart @@ -209,8 +159,27 @@ in SystemCallErrorNumber = "EPERM"; SystemCallFilter = [ "@system-service" ]; - # Required for ProtectSystem=strict - BindPaths = [ stateDir ]; + StateDirectory = "unifi"; + RuntimeDirectory = "unifi"; + LogsDirectory = "unifi"; + CacheDirectory= "unifi"; + + TemporaryFileSystem = [ + # required as we want to create bind mounts below + "${stateDir}/webapps:rw" + ]; + + # We must create the binary directories as bind mounts instead of symlinks + # This is because the controller resolves all symlinks to absolute paths + # to be used as the working directory. + BindPaths = [ + "/var/log/unifi:${stateDir}/logs" + "/run/unifi:${stateDir}/run" + "${cfg.unifiPackage}/dl:${stateDir}/dl" + "${cfg.unifiPackage}/lib:${stateDir}/lib" + "${cfg.mongodbPackage}/bin:${stateDir}/bin" + "${cfg.unifiPackage}/webapps/ROOT:${stateDir}/webapps/ROOT" + ]; # Needs network access PrivateNetwork = false; @@ -220,6 +189,9 @@ in }; }; + imports = [ + (mkRemovedOptionModule [ "services" "unifi" "dataDir" ] "You should move contents of dataDir to /var/lib/unifi/data" ) + ]; meta.maintainers = with lib.maintainers; [ erictapen pennae ]; } |