commit 9e1fe5cddd5c786c0fcceff37a90d9837dc68bcb · pyrox.dev/nixpkgs

+15 -3

nixos/modules/services/backup/restic-rest-server.nix

···

       12
       12
        
           enable = mkEnableOption (lib.mdDoc "Restic REST Server");

     

       13
       13
        
       

     

       14
       14
        
           listenAddress = mkOption {

     

       15
       15
       -
             default = ":8000";

     

       15
       15
       +
             default = "8000";

     

       16
       16
        
             example = "127.0.0.1:8080";

     

       17
       17
        
             type = types.str;

     

       18
       18
        
             description = lib.mdDoc "Listen on a specific IP address and port.";

     
···

       61
       61
        
         };

     

       62
       62
        
       

     

       63
       63
        
         config = mkIf cfg.enable {

     

       64
       64
       +
           assertions = [{

     

       65
       65
       +
             assertion = lib.substring 0 1 cfg.listenAddress != ":";

     

       66
       66
       +
             message = "The restic-rest-server now uses systemd socket activation, which expects only the Port number: services.restic.server.listenAddress = \"${lib.substring 1 6 cfg.listenAddress}\";";

     

       67
       67
       +
           }];

     

       68
       68
       +
       

     

       64
       69
        
           systemd.services.restic-rest-server = {

     

       65
       70
        
             description = "Restic REST Server";

     

       66
       66
       -
             after = [ "network.target" ];

     

       71
       71
       +
             after = [ "network.target" "restic-rest-server.socket" ];

     

       72
       72
       +
             requires = [ "restic-rest-server.socket" ];

     

       67
       73
        
             wantedBy = [ "multi-user.target" ];

     

       68
       74
        
             serviceConfig = {

     

       69
       75
        
               ExecStart = ''

     

       70
       76
        
                 ${cfg.package}/bin/rest-server \

     

       71
       71
       -
                 --listen ${cfg.listenAddress} \

     

       72
       77
        
                 --path ${cfg.dataDir} \

     

       73
       78
        
                 ${optionalString cfg.appendOnly "--append-only"} \

     

       74
       79
        
                 ${optionalString cfg.privateRepos "--private-repos"} \

     
···

       84
       89
        
               LockPersonality = true;

     

       85
       90
        
               MemoryDenyWriteExecute = true;

     

       86
       91
        
               NoNewPrivileges = true;

     

       92
       92
       +
               PrivateNetwork = true;

     

       87
       93
        
               PrivateTmp = true;

     

       88
       94
        
               PrivateUsers = true;

     

       89
       95
        
               ProtectClock = true;

     
···

       98
       104
        
               PrivateDevices = true;

     

       99
       105
        
               ReadWritePaths = [ cfg.dataDir ];

     

       100
       106
        
               RemoveIPC = true;

     

       107
       107
       +
               RestrictAddressFamilies = "none";

     

       101
       108
        
               RestrictNamespaces = true;

     

       102
       109
        
               RestrictRealtime = true;

     

       103
       110
        
               RestrictSUIDSGID = true;

     
···

       105
       112
        
               SystemCallFilter = "@system-service";

     

       106
       113
        
               UMask = 027;

     

       107
       114
        
             };

     

       115
       115
       +
           };

     

       116
       116
       +
       

     

       117
       117
       +
           systemd.sockets.restic-rest-server = {

     

       118
       118
       +
             listenStreams = [ cfg.listenAddress ];

     

       119
       119
       +
             wantedBy = [ "sockets.target" ];

     

       108
       120
        
           };

     

       109
       121
        
       

     

       110
       122
        
           systemd.tmpfiles.rules = mkIf cfg.privateRepos [

+2 -2

nixos/tests/restic-rest-server.nix

···

       44
       44
        
               services.restic.server = {

     

       45
       45
        
                 enable = true;

     

       46
       46
        
                 extraFlags = [ "--no-auth" ];

     

       47
       47
       -
                 listenAddress = ":8001";

     

       47
       47
       +
                 listenAddress = "8001";

     

       48
       48
        
               };

     

       49
       49
        
               networking.firewall.allowedTCPPorts = [ 8001 ];

     

       50
       50
        
             };

     
···

       68
       68
        
           testScript = ''

     

       69
       69
        
             restic_rest_server.start()

     

       70
       70
        
             server.start()

     

       71
       71
       -
             restic_rest_server.wait_for_unit("restic-rest-server.service")

     

       71
       71
       +
             restic_rest_server.wait_for_unit("restic-rest-server.socket")

     

       72
       72
        
             restic_rest_server.wait_for_open_port(8001)

     

       73
       73
        
             server.wait_for_unit("dbus.socket")

     

       74
       74
        
             server.fail(