|
5 | 5 | ... |
6 | 6 | }: |
7 | 7 |
|
8 | | -with lib; |
9 | | - |
10 | 8 | let |
11 | 9 | cfg = config.services.varnish; |
12 | 10 |
|
| 11 | + # Varnish has very strong opinions and very complicated code around handling |
| 12 | + # the stateDir. After a lot of back and forth, we decided that we a) |
| 13 | + # do not want a configurable option here, as most of the handling depends |
| 14 | + # on the version and the compile time options. Putting everything into |
| 15 | + # /var/run (RAM backed) is absolutely recommended by Varnish anyways. |
| 16 | + # We do need to pay attention to the version-dependend variations, though! |
| 17 | + stateDir = |
| 18 | + if |
| 19 | + (lib.versionOlder cfg.package.version "7") |
| 20 | + # Remove after Varnish 6.0 is gone. In 6.0 varnishadm always appends the |
| 21 | + # hostname (by default) and can't be nudged to not use any name. This has |
| 22 | + # long changed by 7.5 and can be used without the host name. |
| 23 | + then |
| 24 | + "/var/run/varnish/${config.networking.hostName}" |
| 25 | + # Newer varnish uses this: |
| 26 | + else |
| 27 | + "/var/run/varnishd"; |
| 28 | + |
13 | 29 | commandLine = |
14 | 30 | "-f ${pkgs.writeText "default.vcl" cfg.config}" |
15 | 31 | + |
16 | | - optionalString (cfg.extraModules != [ ]) |
| 32 | + lib.optionalString (cfg.extraModules != [ ]) |
17 | 33 | " -p vmod_path='${ |
18 | | - makeSearchPathOutput "lib" "lib/varnish/vmods" ([ cfg.package ] ++ cfg.extraModules) |
| 34 | + lib.makeSearchPathOutput "lib" "lib/varnish/vmods" ([ cfg.package ] ++ cfg.extraModules) |
19 | 35 | }' -r vmod_path"; |
20 | 36 | in |
21 | 37 | { |
| 38 | + imports = [ |
| 39 | + (lib.mkRemovedOptionModule [ |
| 40 | + "services" |
| 41 | + "varnish" |
| 42 | + "stateDir" |
| 43 | + ] "The `stateDir` option never was functional or useful. varnish uses compile-time settings.") |
| 44 | + ]; |
| 45 | + |
22 | 46 | options = { |
23 | 47 | services.varnish = { |
24 | | - enable = mkEnableOption "Varnish Server"; |
| 48 | + enable = lib.mkEnableOption "Varnish Server"; |
25 | 49 |
|
26 | | - enableConfigCheck = mkEnableOption "checking the config during build time" // { |
| 50 | + enableConfigCheck = lib.mkEnableOption "checking the config during build time" // { |
27 | 51 | default = true; |
28 | 52 | }; |
29 | 53 |
|
30 | | - package = mkPackageOption pkgs "varnish" { }; |
| 54 | + package = lib.mkPackageOption pkgs "varnish" { }; |
31 | 55 |
|
32 | | - http_address = mkOption { |
33 | | - type = types.str; |
| 56 | + http_address = lib.mkOption { |
| 57 | + type = lib.types.str; |
34 | 58 | default = "*:6081"; |
35 | 59 | description = '' |
36 | 60 | HTTP listen address and port. |
37 | 61 | ''; |
38 | 62 | }; |
39 | 63 |
|
40 | | - config = mkOption { |
41 | | - type = types.lines; |
| 64 | + config = lib.mkOption { |
| 65 | + type = lib.types.lines; |
42 | 66 | description = '' |
43 | 67 | Verbatim default.vcl configuration. |
44 | 68 | ''; |
45 | 69 | }; |
46 | 70 |
|
47 | | - stateDir = mkOption { |
48 | | - type = types.path; |
49 | | - default = "/run/varnish/${config.networking.hostName}"; |
50 | | - defaultText = literalExpression ''"/run/varnish/''${config.networking.hostName}"''; |
51 | | - description = '' |
52 | | - Directory holding all state for Varnish to run. Note that this should be a tmpfs in order to avoid performance issues and crashes. |
53 | | - ''; |
54 | | - }; |
55 | | - |
56 | | - extraModules = mkOption { |
57 | | - type = types.listOf types.package; |
| 71 | + extraModules = lib.mkOption { |
| 72 | + type = lib.types.listOf lib.types.package; |
58 | 73 | default = [ ]; |
59 | | - example = literalExpression "[ pkgs.varnishPackages.geoip ]"; |
| 74 | + example = lib.literalExpression "[ pkgs.varnishPackages.geoip ]"; |
60 | 75 | description = '' |
61 | 76 | Varnish modules (except 'std'). |
62 | 77 | ''; |
63 | 78 | }; |
64 | 79 |
|
65 | | - extraCommandLine = mkOption { |
66 | | - type = types.str; |
| 80 | + extraCommandLine = lib.mkOption { |
| 81 | + type = lib.types.str; |
67 | 82 | default = ""; |
68 | 83 | example = "-s malloc,256M"; |
69 | 84 | description = '' |
|
74 | 89 |
|
75 | 90 | }; |
76 | 91 |
|
77 | | - config = mkIf cfg.enable { |
78 | | - |
| 92 | + config = lib.mkIf cfg.enable { |
79 | 93 | systemd.services.varnish = { |
80 | 94 | description = "Varnish"; |
81 | 95 | wantedBy = [ "multi-user.target" ]; |
82 | 96 | after = [ "network.target" ]; |
83 | | - preStart = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) '' |
84 | | - mkdir -p ${cfg.stateDir} |
85 | | - chown -R varnish:varnish ${cfg.stateDir} |
86 | | - ''; |
87 | | - postStop = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) '' |
88 | | - rm -rf ${cfg.stateDir} |
89 | | - ''; |
90 | 97 | serviceConfig = { |
91 | 98 | Type = "simple"; |
92 | 99 | PermissionsStartOnly = true; |
93 | | - ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${cfg.stateDir} -F ${cfg.extraCommandLine} ${commandLine}"; |
| 100 | + ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}"; |
94 | 101 | Restart = "always"; |
95 | 102 | RestartSec = "5s"; |
96 | 103 | User = "varnish"; |
97 | 104 | Group = "varnish"; |
98 | | - RuntimeDirectory = mkIf (lib.hasPrefix "/run/" cfg.stateDir) ( |
99 | | - lib.removePrefix "/run/" cfg.stateDir |
100 | | - ); |
| 105 | + RuntimeDirectory = lib.removePrefix "/var/run/" stateDir; |
101 | 106 | AmbientCapabilities = "cap_net_bind_service"; |
102 | 107 | NoNewPrivileges = true; |
103 | 108 | LimitNOFILE = 131072; |
|
107 | 112 | environment.systemPackages = [ cfg.package ]; |
108 | 113 |
|
109 | 114 | # check .vcl syntax at compile time (e.g. before nixops deployment) |
110 | | - system.checks = mkIf cfg.enableConfigCheck [ |
| 115 | + system.checks = lib.mkIf cfg.enableConfigCheck [ |
111 | 116 | (pkgs.runCommand "check-varnish-syntax" { } '' |
112 | 117 | ${cfg.package}/bin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1) |
113 | 118 | '') |
|
0 commit comments