stockholm/krebs/3modules/permown.nix

119 lines
3.2 KiB
Nix
Raw Normal View History

2023-07-04 11:33:54 +02:00
{ config, pkgs, lib, ... }: let
slib = import ../../lib/pure.nix { inherit lib; };
in
2023-06-10 12:50:53 +02:00
with lib; {
options.krebs.permown = mkOption {
2019-04-18 01:23:12 +02:00
default = {};
type = types.attrsOf (types.submodule ({ config, ... }: {
options = {
directory-mode = mkOption {
default = "=rwx";
type = types.str; # TODO
};
file-mode = mkOption {
default = "=rw";
type = types.str; # TODO
};
group = mkOption {
apply = x: if x == null then "" else x;
default = null;
2023-07-04 11:33:54 +02:00
type = types.nullOr slib.types.groupname;
};
2020-09-08 21:47:29 +02:00
keepGoing = mkOption {
default = false;
type = types.bool;
description = ''
Whether to keep going when chowning or chmodding fails.
If set to false, then errors will cause the service to restart
instead.
'';
};
owner = mkOption {
2023-07-04 11:33:54 +02:00
type = slib.types.username;
};
path = mkOption {
2019-04-18 01:23:12 +02:00
default = config._module.args.name;
2023-07-04 11:33:54 +02:00
type = slib.types.absolute-pathname;
};
umask = mkOption {
default = "0027";
2023-07-04 11:33:54 +02:00
type = slib.types.file-mode;
};
};
2019-04-18 01:23:12 +02:00
}));
};
2019-04-18 01:23:12 +02:00
config = let
plans = attrValues config.krebs.permown;
in mkIf (plans != []) {
2019-04-18 01:23:12 +02:00
2019-04-18 01:23:55 +02:00
system.activationScripts.permown = let
mkdir = plan: /* sh */ ''
2023-07-04 11:33:54 +02:00
${pkgs.coreutils}/bin/mkdir -p ${slib.shell.escape plan.path}
2019-04-18 01:23:55 +02:00
'';
in concatMapStrings mkdir plans;
2023-07-04 11:33:54 +02:00
systemd.services = slib.genAttrs' plans (plan: let
2020-09-08 21:47:29 +02:00
continuable = command:
if plan.keepGoing
then /* sh */ "{ ${command}; } || :"
else command;
in {
2019-04-18 01:23:12 +02:00
name = "permown.${replaceStrings ["/"] ["_"] plan.path}";
value = {
environment = {
DIR_MODE = plan.directory-mode;
FILE_MODE = plan.file-mode;
OWNER_GROUP = "${plan.owner}:${plan.group}";
ROOT_PATH = plan.path;
};
path = [
pkgs.coreutils
pkgs.findutils
2022-09-27 12:24:05 +02:00
pkgs.inotify-tools
2019-04-18 01:23:12 +02:00
];
serviceConfig = {
ExecStart = pkgs.writeDash "permown" ''
set -efu
2019-04-18 11:00:56 +02:00
find "$ROOT_PATH" -exec chown -h "$OWNER_GROUP" {} +
2019-04-18 01:23:12 +02:00
find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} +
find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} +
paths=/tmp/paths
rm -f "$paths"
mkfifo "$paths"
inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" > "$paths" &
inotifywaitpid=$!
trap cleanup EXIT
cleanup() {
kill "$inotifywaitpid"
}
2019-04-18 01:23:12 +02:00
while read -r path; do
if test -d "$path"; then
cleanup
2019-04-18 01:23:12 +02:00
exec "$0" "$@"
fi
2020-09-08 21:47:29 +02:00
${continuable /* sh */ ''chown -h "$OWNER_GROUP" "$path"''}
2019-04-18 11:00:56 +02:00
if test -f "$path"; then
2020-09-08 21:47:29 +02:00
${continuable /* sh */ ''chmod "$FILE_MODE" "$path"''}
2019-04-18 11:00:56 +02:00
fi
done < "$paths"
2019-04-18 01:23:12 +02:00
'';
2019-04-19 13:58:38 +02:00
PrivateTmp = true;
2019-04-18 01:23:12 +02:00
Restart = "always";
RestartSec = 10;
UMask = plan.umask;
};
wantedBy = [ "multi-user.target" ];
};
2019-04-18 01:23:12 +02:00
});
};
}