motiejus
/
config
1
Fork 0
Code Packages Releases Activity

doas -> setpriv

This commit is contained in:
Motiejus Jakštys 2024-09-29 23:14:41 +03:00
parent 4ca6a90975
commit e3b348d5c0
1 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
modules/services/immich/default.nix
View File

@ -13,16 +13,23 @@ let
immich-group = config.services.immich.group; immich-group = config.services.immich.group;
startScript = pkgs.writeShellApplication { startScript = pkgs.writeShellApplication {
name = "immich-mj"; name = "immich-mj";
runtimeInputs = with pkgs; [ bindfs ]; runtimeInputs = with pkgs; [
bindfs
util-linux
];
text = '' text = ''
set -x set -x
${lib.concatLines ( ${lib.concatLines (
map (name: '' map
(name: ''
mkdir /data/${name} mkdir /data/${name}
bindfs -u ${cfg.bindAsUser} /var/cache/immich/bind-paths/${name} /data/${name} bindfs -u ${cfg.bindAsUser} /var/run/immich/bind-paths/${name} /data/${name}'')
'') (lib.attrNames cfg.bindPaths) (lib.attrNames cfg.bindPaths)
)} )}
exec ${config.security.wrapperDir}/doas -u ${immich-user} ${lib.getExe immich-package} exec setpriv \
--ruid ${immich-user} \
--inh-caps -sys_admin,-setuid,-setgid \
${lib.getExe immich-package}
''; '';
}; };
in in
@ -36,7 +43,6 @@ in
imports = [ "${nixpkgs-unstable}/nixos/modules/services/web-apps/immich.nix" ]; imports = [ "${nixpkgs-unstable}/nixos/modules/services/web-apps/immich.nix" ];
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
security.doas.enable = true;
services.immich = { services.immich = {
package = immich-package; package = immich-package;
enable = true; enable = true;
@ -51,13 +57,13 @@ in
systemd = { systemd = {
tmpfiles.rules = [ tmpfiles.rules = [
"d /data 0755 root root -" "d /data 0755 root root -"
"d /var/cache/immich/bind-paths 0755 ${immich-user} ${immich-group} -" "d /var/run/immich/bind-paths 0755 ${immich-user} ${immich-group} -"
]; ];
services.immich-server.serviceConfig = { services.immich-server.serviceConfig = {
RuntimeDirectory = "immich"; RuntimeDirectory = "immich";
TemporaryFileSystem = "/data"; TemporaryFileSystem = "/data";
BindPaths = lib.mapAttrsToList ( BindPaths = lib.mapAttrsToList (
name: srcpath: "${srcpath}:/var/cache/immich/bind-paths/${name}" name: srcpath: "${srcpath}:/var/run/immich/bind-paths/${name}"
) cfg.bindPaths; ) cfg.bindPaths;
PrivateDevices = lib.mkForce false; # /dev/fuse PrivateDevices = lib.mkForce false; # /dev/fuse
CapabilityBoundingSet = lib.mkForce "CAP_SYS_ADMIN | CAP_SETUID | CAP_SETGID"; CapabilityBoundingSet = lib.mkForce "CAP_SYS_ADMIN | CAP_SETUID | CAP_SETGID";