2014-04-14 14:26:48 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
2007-01-11 23:55:25 +00:00
|
|
|
|
2014-04-14 14:26:48 +00:00
|
|
|
with lib;
|
2009-12-16 20:51:25 +00:00
|
|
|
|
2009-03-06 12:27:40 +00:00
|
|
|
let
|
2009-07-15 11:34:55 +00:00
|
|
|
|
2009-03-06 12:27:40 +00:00
|
|
|
nssModulesPath = config.system.nssModules.path;
|
2014-01-31 13:07:44 +00:00
|
|
|
cfg = config.services.nscd;
|
2009-07-15 11:34:55 +00:00
|
|
|
|
2009-03-06 12:27:40 +00:00
|
|
|
in
|
2007-01-11 23:55:25 +00:00
|
|
|
|
2009-03-06 12:27:40 +00:00
|
|
|
{
|
2009-12-16 20:51:25 +00:00
|
|
|
|
|
|
|
###### interface
|
|
|
|
|
|
|
|
options = {
|
|
|
|
|
|
|
|
services.nscd = {
|
|
|
|
|
|
|
|
enable = mkOption {
|
2013-10-30 16:37:45 +00:00
|
|
|
type = types.bool;
|
2009-12-16 20:51:25 +00:00
|
|
|
default = true;
|
2020-04-25 16:09:51 +00:00
|
|
|
description = lib.mdDoc ''
|
|
|
|
Whether to enable the Name Service Cache Daemon.
|
|
|
|
Disabling this is strongly discouraged, as this effectively disables NSS Lookups
|
|
|
|
from all non-glibc NSS modules, including the ones provided by systemd.
|
|
|
|
'';
|
2009-12-16 20:51:25 +00:00
|
|
|
};
|
|
|
|
|
2022-10-07 08:53:14 +00:00
|
|
|
enableNsncd = mkOption {
|
|
|
|
type = types.bool;
|
2023-02-02 10:02:10 +00:00
|
|
|
default = true;
|
2022-10-07 08:53:14 +00:00
|
|
|
description = lib.mdDoc ''
|
2023-02-02 10:02:10 +00:00
|
|
|
Whether to use nsncd instead of nscd from glibc.
|
2022-10-07 08:53:14 +00:00
|
|
|
This is a nscd-compatible daemon, that proxies lookups, without any caching.
|
2023-02-02 10:02:10 +00:00
|
|
|
Using nscd from glibc is discouraged.
|
2022-10-07 08:53:14 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2022-07-29 13:50:25 +00:00
|
|
|
user = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = "nscd";
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
User account under which nscd runs.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
group = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = "nscd";
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
User group under which nscd runs.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2014-01-31 13:07:44 +00:00
|
|
|
config = mkOption {
|
|
|
|
type = types.lines;
|
|
|
|
default = builtins.readFile ./nscd.conf;
|
2023-02-02 10:02:10 +00:00
|
|
|
description = lib.mdDoc ''
|
|
|
|
Configuration to use for Name Service Cache Daemon.
|
|
|
|
Only used in case glibc-nscd is used.
|
|
|
|
'';
|
2014-01-31 13:07:44 +00:00
|
|
|
};
|
|
|
|
|
2021-05-22 07:07:18 +00:00
|
|
|
package = mkOption {
|
|
|
|
type = types.package;
|
2022-10-07 08:47:45 +00:00
|
|
|
default =
|
|
|
|
if pkgs.stdenv.hostPlatform.libc == "glibc"
|
2021-05-22 07:07:18 +00:00
|
|
|
then pkgs.stdenv.cc.libc.bin
|
|
|
|
else pkgs.glibc.bin;
|
2022-04-26 12:06:52 +00:00
|
|
|
defaultText = lib.literalExpression ''
|
2022-04-18 12:47:53 +00:00
|
|
|
if pkgs.stdenv.hostPlatform.libc == "glibc"
|
|
|
|
then pkgs.stdenv.cc.libc.bin
|
|
|
|
else pkgs.glibc.bin;
|
|
|
|
'';
|
2022-10-07 08:53:14 +00:00
|
|
|
description = lib.mdDoc ''
|
|
|
|
package containing the nscd binary to be used by the service.
|
|
|
|
Ignored when enableNsncd is set to true.
|
|
|
|
'';
|
2021-05-22 07:07:18 +00:00
|
|
|
};
|
|
|
|
|
2009-12-16 20:51:25 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
};
|
|
|
|
|
2012-08-06 16:26:52 +00:00
|
|
|
|
2009-12-16 20:51:25 +00:00
|
|
|
###### implementation
|
|
|
|
|
2014-01-31 13:07:44 +00:00
|
|
|
config = mkIf cfg.enable {
|
2016-04-14 18:18:09 +00:00
|
|
|
environment.etc."nscd.conf".text = cfg.config;
|
2011-09-14 18:20:50 +00:00
|
|
|
|
2022-07-29 13:50:25 +00:00
|
|
|
users.users.${cfg.user} = {
|
|
|
|
isSystemUser = true;
|
|
|
|
group = cfg.group;
|
|
|
|
};
|
|
|
|
|
2022-10-07 08:47:45 +00:00
|
|
|
users.groups.${cfg.group} = { };
|
2022-07-29 13:50:25 +00:00
|
|
|
|
2013-01-16 11:33:18 +00:00
|
|
|
systemd.services.nscd =
|
2022-10-07 08:47:45 +00:00
|
|
|
{
|
2022-10-07 08:53:14 +00:00
|
|
|
description = "Name Service Cache Daemon"
|
|
|
|
+ lib.optionalString cfg.enableNsncd " (nsncd)";
|
2009-07-15 11:34:55 +00:00
|
|
|
|
2022-01-10 18:30:15 +00:00
|
|
|
before = [ "nss-lookup.target" "nss-user-lookup.target" ];
|
|
|
|
wants = [ "nss-lookup.target" "nss-user-lookup.target" ];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
2022-08-15 11:18:03 +00:00
|
|
|
requiredBy = [ "nss-lookup.target" "nss-user-lookup.target" ];
|
2009-07-15 11:34:55 +00:00
|
|
|
|
2009-07-15 15:24:11 +00:00
|
|
|
environment = { LD_LIBRARY_PATH = nssModulesPath; };
|
2011-09-14 18:20:50 +00:00
|
|
|
|
2022-10-07 08:53:14 +00:00
|
|
|
restartTriggers = lib.optionals (!cfg.enableNsncd) ([
|
2016-04-14 18:18:09 +00:00
|
|
|
config.environment.etc.hosts.source
|
|
|
|
config.environment.etc."nsswitch.conf".source
|
|
|
|
config.environment.etc."nscd.conf".source
|
2022-07-29 15:23:44 +00:00
|
|
|
] ++ optionals config.users.mysql.enable [
|
|
|
|
config.environment.etc."libnss-mysql.cfg".source
|
|
|
|
config.environment.etc."libnss-mysql-root.cfg".source
|
2022-10-07 08:53:14 +00:00
|
|
|
]);
|
2013-06-11 14:15:24 +00:00
|
|
|
|
2022-07-29 13:50:25 +00:00
|
|
|
# In some configurations, nscd needs to be started as root; it will
|
|
|
|
# drop privileges after all the NSS modules have read their
|
|
|
|
# configuration files. So prefix the ExecStart command with "!" to
|
|
|
|
# prevent systemd from dropping privileges early. See ExecStart in
|
|
|
|
# systemd.service(5). We use a static user, because some NSS modules
|
|
|
|
# sill want to read their configuration files after the privilege drop
|
|
|
|
# and so users can set the owner of those files to the nscd user.
|
2012-08-14 20:45:50 +00:00
|
|
|
serviceConfig =
|
2022-10-07 08:47:45 +00:00
|
|
|
{
|
2022-10-07 08:53:14 +00:00
|
|
|
ExecStart =
|
|
|
|
if cfg.enableNsncd then "${pkgs.nsncd}/bin/nsncd"
|
|
|
|
else "!@${cfg.package}/bin/nscd nscd";
|
|
|
|
Type = if cfg.enableNsncd then "notify" else "forking";
|
2022-07-29 13:50:25 +00:00
|
|
|
User = cfg.user;
|
|
|
|
Group = cfg.group;
|
|
|
|
RemoveIPC = true;
|
|
|
|
PrivateTmp = true;
|
|
|
|
NoNewPrivileges = true;
|
|
|
|
RestrictSUIDSGID = true;
|
|
|
|
ProtectSystem = "strict";
|
|
|
|
ProtectHome = "read-only";
|
nixos/nscd: let systemd manage directories
Previously this module created both /var/db/nscd and /run/nscd using
shell commands in a preStart script. Note that both of these paths are
hard-coded in the nscd source. (Well, the latter is actually
/var/run/nscd but /var/run is a symlink to /run so it works out the
same.)
/var/db/nscd is only used if the nscd.conf "persistent" option is turned
on for one or more databases, which it is not in our default config
file. I'm not even sure persistent mode can work under systemd, since
`nscd --shutdown` is not synchronous so systemd will always
unceremoniously kill nscd without reliably giving it time to mark the
databases as unused. Nonetheless, if someone wants to use that option,
they can ensure the directory exists using systemd.tmpfiles.rules.
systemd can create /run/nscd for us with the RuntimeDirectory directive,
with the added benefit of causing systemd to delete the directory on
service stop or restart. The default value of RuntimeDirectoryMode is
755, the same as the mode which this module was using before.
I don't think the `rm -f /run/nscd/nscd.pid` was necessary after NixOS
switched to systemd and used its PIDFile directive, because systemd
deletes the specified file after the service stops, and because the file
can't persist across reboots since /run is a tmpfs. Even if the file
still exists when nscd starts, it's only a problem if the pid it
contains has been reused by another process, which is unlikely. Anyway,
this change makes that deletion even less necessary, because now systemd
deletes the entire /run/nscd directory when the service stops.
2019-07-03 19:39:48 +00:00
|
|
|
RuntimeDirectory = "nscd";
|
2012-10-01 20:27:42 +00:00
|
|
|
PIDFile = "/run/nscd/nscd.pid";
|
|
|
|
Restart = "always";
|
|
|
|
ExecReload =
|
2022-10-07 08:53:14 +00:00
|
|
|
lib.optionals (!cfg.enableNsncd) [
|
2022-10-07 08:47:45 +00:00
|
|
|
"${cfg.package}/bin/nscd --invalidate passwd"
|
2021-05-22 07:07:18 +00:00
|
|
|
"${cfg.package}/bin/nscd --invalidate group"
|
|
|
|
"${cfg.package}/bin/nscd --invalidate hosts"
|
2012-10-01 20:27:42 +00:00
|
|
|
];
|
|
|
|
};
|
2012-01-21 19:13:43 +00:00
|
|
|
};
|
2009-03-06 12:27:40 +00:00
|
|
|
};
|
2007-01-11 23:55:25 +00:00
|
|
|
}
|