|
74 | 74 | }; |
75 | 75 |
|
76 | 76 | installSecrets = |
77 | | - source: target: secrets: |
| 77 | + source: target: owner: secrets: |
78 | 78 | pkgs.writeShellScript "installSecrets.sh" '' |
79 | | - install -m0600 -D ${source} "${target}" |
| 79 | + install -m0600 -o${owner} -D ${source} "${target}" |
80 | 80 | ${lib.concatLines ( |
81 | 81 | lib.forEach secrets (name: '' |
82 | 82 | ${pkgs.replace-secret}/bin/replace-secret \ |
|
327 | 327 | description = "Whether to enable `upsmon`."; |
328 | 328 | }; |
329 | 329 |
|
| 330 | + user = lib.mkOption { |
| 331 | + type = lib.types.str; |
| 332 | + default = "nutmon"; |
| 333 | + description = '' |
| 334 | + User to run `upsmon` as. `upsmon.conf` will have its owner set to this |
| 335 | + user. If not specified, a default user will be created. |
| 336 | + ''; |
| 337 | + }; |
| 338 | + group = lib.mkOption { |
| 339 | + type = lib.types.str; |
| 340 | + default = "nutmon"; |
| 341 | + description = '' |
| 342 | + Group for the default `nutmon` user. If the default user is created |
| 343 | + and this is not specified, a default group will be created. |
| 344 | + ''; |
| 345 | + }; |
| 346 | + |
330 | 347 | monitor = lib.mkOption { |
331 | 348 | type = with lib.types; attrsOf (submodule monitorOptions); |
332 | 349 | default = { }; |
|
344 | 361 | MONITOR = <generated from config.power.ups.upsmon.monitor> |
345 | 362 | NOTIFYCMD = "''${pkgs.nut}/bin/upssched"; |
346 | 363 | POWERDOWNFLAG = "/run/killpower"; |
347 | | - RUN_AS_USER = "root"; |
348 | 364 | SHUTDOWNCMD = "''${pkgs.systemd}/bin/shutdown now"; |
349 | 365 | } |
350 | 366 | ''; |
|
382 | 398 | ); |
383 | 399 | NOTIFYCMD = lib.mkDefault "${pkgs.nut}/bin/upssched"; |
384 | 400 | POWERDOWNFLAG = lib.mkDefault "/run/killpower"; |
385 | | - RUN_AS_USER = "root"; # TODO: replace 'root' by another username. |
386 | 401 | SHUTDOWNCMD = lib.mkDefault "${pkgs.systemd}/bin/shutdown now"; |
387 | 402 | }; |
388 | 403 | }; |
|
581 | 596 | systemd.services.upsmon = |
582 | 597 | let |
583 | 598 | secrets = lib.mapAttrsToList (name: monitor: "upsmon_password_${name}") cfg.upsmon.monitor; |
584 | | - createUpsmonConf = installSecrets upsmonConf "/run/nut/upsmon.conf" secrets; |
| 599 | + createUpsmonConf = installSecrets upsmonConf "/run/nut/upsmon.conf" cfg.upsmon.user secrets; |
585 | 600 | in |
586 | 601 | { |
587 | 602 | enable = cfg.upsmon.enable; |
|
591 | 606 | serviceConfig = { |
592 | 607 | Type = "forking"; |
593 | 608 | ExecStartPre = "${createUpsmonConf}"; |
594 | | - ExecStart = "${pkgs.nut}/sbin/upsmon"; |
| 609 | + ExecStart = "${pkgs.nut}/sbin/upsmon -u ${cfg.upsmon.user}"; |
595 | 610 | ExecReload = "${pkgs.nut}/sbin/upsmon -c reload"; |
596 | 611 | LoadCredential = lib.mapAttrsToList ( |
597 | 612 | name: monitor: "upsmon_password_${name}:${monitor.passwordFile}" |
|
604 | 619 | systemd.services.upsd = |
605 | 620 | let |
606 | 621 | secrets = lib.mapAttrsToList (name: user: "upsdusers_password_${name}") cfg.users; |
607 | | - createUpsdUsers = installSecrets upsdUsers "/run/nut/upsd.users" secrets; |
| 622 | + createUpsdUsers = installSecrets upsdUsers "/run/nut/upsd.users" "root" secrets; |
608 | 623 | in |
609 | 624 | { |
610 | 625 | enable = cfg.upsd.enable; |
|
696 | 711 |
|
697 | 712 | services.udev.packages = [ pkgs.nut ]; |
698 | 713 |
|
699 | | - /* |
700 | | - users.users.nut = |
701 | | - { uid = 84; |
702 | | - home = "/var/lib/nut"; |
703 | | - createHome = true; |
704 | | - group = "nut"; |
705 | | - description = "UPnP A/V Media Server user"; |
706 | | - }; |
707 | | -
|
708 | | - users.groups."nut" = |
709 | | - { gid = 84; }; |
710 | | - */ |
| 714 | + users.users.nutmon = lib.mkIf (cfg.upsmon.user == "nutmon") { |
| 715 | + isSystemUser = true; |
| 716 | + group = cfg.upsmon.group; |
| 717 | + }; |
| 718 | + users.groups.nutmon = lib.mkIf (cfg.upsmon.user == "nutmon" && cfg.upsmon.group == "nutmon") { }; |
711 | 719 |
|
712 | 720 | }; |
713 | 721 | } |
0 commit comments