commit 88029bce39bd485fc07f1b2aa111c3ee9d12e684 · pyrox.dev/nixpkgs

+8 -1
nixos/modules/services/networking/knot.nix
···

       65
       65
        
         };

     

       66
       66
        
       

     

       67
       67
        
         config = mkIf config.services.knot.enable {

     

       68
       68
       +
           users.users.knot = {

     

       69
       69
       +
             isSystemUser = true;

     

       70
       70
       +
             group = "knot";

     

       71
       71
       +
             description = "Knot daemon user";

     

       72
       72
       +
           };

     

       73
       73
       +
       

     

       74
       74
       +
           users.groups.knot.gid = null;

     

       68
       75
        
           systemd.services.knot = {

     

       69
       76
        
             unitConfig.Documentation = "man:knotd(8) man:knot.conf(5) man:knotc(8) https://www.knot-dns.cz/docs/${cfg.package.version}/html/";

     

       70
       77
        
             description = cfg.package.meta.description;

     
···

       79
       86
        
               CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETPCAP";

     

       80
       87
        
               AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETPCAP";

     

       81
       88
        
               NoNewPrivileges = true;

     

       82
       82
       -
               DynamicUser = "yes";

     

       89
       89
       +
               User = "knot";

     

       83
       90
        
               RuntimeDirectory = "knot";

     

       84
       91
        
               StateDirectory = "knot";

     

       85
       92
        
               StateDirectoryMode = "0700";