commit 604a820cfd5232622017bf6033ac946a9ec7fce7 · pyrox.dev/nixpkgs

+33 -8
nixos/modules/services/networking/netbird.nix
···

       543
       543
        
                 after = [ "network.target" ];

     

       544
       544
        
                 wantedBy = [ "multi-user.target" ];

     

       545
       545
        
       

     

       546
       546
       -
                 path =

     

       547
       547
       -
                   optionals (!config.services.resolved.enable) [ pkgs.openresolv ]

     

       548
       548
       -
                   # useful for `netbird debug` system info gathering

     

       549
       549
       -
                   ++ optionals config.networking.nftables.enable [ pkgs.nftables ]

     

       550
       550
       -
                   ++ optionals (!config.networking.nftables.enable) [

     

       551
       551
       -
                     pkgs.iptables

     

       552
       552
       -
                     pkgs.ipset

     

       553
       553
       -
                   ];

     

       546
       546
       +
                 path = optionals (!config.services.resolved.enable) [ pkgs.openresolv ];

     

       554
       547
        
       

     

       555
       548
        
                 serviceConfig = {

     

       556
       549
        
                   ExecStart = "${getExe client.wrapper} service run";

     
···

       571
       564
        
                 };

     

       572
       565
        
       

     

       573
       566
        
                 stopIfChanged = false;

     

       567
       567
       +
               }

     

       568
       568
       +
             );

     

       569
       569
       +
           }

     

       570
       570
       +
           # netbird debug bundle related configurations

     

       571
       571
       +
           {

     

       572
       572
       +
             systemd.services = toClientAttrs (

     

       573
       573
       +
               client:

     

       574
       574
       +
               nameValuePair client.service.name {

     

       575
       575
       +
                 /*

     

       576
       576
       +
                   lets NetBird daemon know which systemd service to gather logs for

     

       577
       577
       +
                   see https://github.com/netbirdio/netbird/blob/2c87fa623654c5eef76bc0226062290201eef13a/client/internal/debug/debug_linux.go#L50-L51

     

       578
       578
       +
                 */

     

       579
       579
       +
                 environment.SYSTEMD_UNIT = client.service.name;

     

       580
       580
       +
       

     

       581
       581
       +
                 path =

     

       582
       582
       +
                   optionals config.networking.nftables.enable [ pkgs.nftables ]

     

       583
       583
       +
                   ++ optionals (!config.networking.nftables.enable) [

     

       584
       584
       +
                     pkgs.iptables

     

       585
       585
       +
                     pkgs.ipset

     

       586
       586
       +
                   ];

     

       587
       587
       +
               }

     

       588
       588
       +
             );

     

       589
       589
       +
             users.users = toHardenedClientAttrs (

     

       590
       590
       +
               client:

     

       591
       591
       +
               nameValuePair client.user.name {

     

       592
       592
       +
                 extraGroups = [

     

       593
       593
       +
                   /*

     

       594
       594
       +
                     allows debug bundles to gather systemd logs for `netbird*.service`

     

       595
       595
       +
                     this is not ideal for hardening as it grants access to the whole journal, not just own logs

     

       596
       596
       +
                   */

     

       597
       597
       +
                   "systemd-journal"

     

       598
       598
       +
                 ];

     

       574
       599
        
               }

     

       575
       600
        
             );

     

       576
       601
        
           }