···

       
10
       
 
       


     

       
11
       
 
       
  postgresql = config.services.postgresql.package;

     

       
12
       
 
       
  mysql = config.services.mysql.package;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
13
       
 
       
  addRequiredBinaries =

     

       
14
       
 
       
    s:

     

       
15
       
 
       
    s

     
···

       
17
       
 
       
      postgresql_databases = map (

     

       
18
       
 
       
        d:

     

       
19
       
 
       
        let

     

       
20
       
-
       
          as_user = if d ? username then "${pkgs.sudo}/bin/sudo -u ${d.username} " else "";

     

       
21
       
 
       
        in

     

       
22
       
 
       
        {

     

       
23
       
 
       
          pg_dump_command =

     
···

       
113
       
 
       
    };

     

       
114
       
 
       


     

       
115
       
 
       
  cfgfile = settingsFormat.generate "config.yaml" (addRequiredBinaries cfg.settings);

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
116
       
 
       
in

     

       
117
       
 
       
{

     

       
118
       
 
       
  options.services.borgmatic = {

     
···

       
173
       
 
       


     

       
174
       
 
       
      systemd.packages = [ pkgs.borgmatic ];

     

       
175
       
 
       
      systemd.services.borgmatic.path = [ pkgs.coreutils ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
176
       
 
       


     

       
177
       
 
       
      # Workaround: https://github.com/NixOS/nixpkgs/issues/81138

     

       
178
       
 
       
      systemd.timers.borgmatic.wantedBy = [ "timers.target" ];

     

···

       
10
       
 
       


     

       
11
       
 
       
  postgresql = config.services.postgresql.package;

     

       
12
       
 
       
  mysql = config.services.mysql.package;

     

       
13
       
+
       
  requireSudo =

     

       
14
       
+
       
    s:

     

       
15
       
+
       
    s ? postgresql_databases

     

       
16
       
+
       
    && lib.any (d: d ? username && !(d ? password) && !(d ? pg_dump_command)) s.postgresql_databases;

     

       
17
       
 
       
  addRequiredBinaries =

     

       
18
       
 
       
    s:

     

       
19
       
 
       
    s

     
···

       
21
       
 
       
      postgresql_databases = map (

     

       
22
       
 
       
        d:

     

       
23
       
 
       
        let

     

       
24
       
+
       
          as_user = if d ? username && !(d ? password) then "${pkgs.sudo}/bin/sudo -u ${d.username} " else "";

     

       
25
       
 
       
        in

     

       
26
       
 
       
        {

     

       
27
       
 
       
          pg_dump_command =

     
···

       
117
       
 
       
    };

     

       
118
       
 
       


     

       
119
       
 
       
  cfgfile = settingsFormat.generate "config.yaml" (addRequiredBinaries cfg.settings);

     

       
120
       
+
       


     

       
121
       
+
       
  anycfgRequiresSudo =

     

       
122
       
+
       
    requireSudo cfg.settings || lib.any requireSudo (lib.attrValues cfg.configurations);

     

       
123
       
 
       
in

     

       
124
       
 
       
{

     

       
125
       
 
       
  options.services.borgmatic = {

     
···

       
180
       
 
       


     

       
181
       
 
       
      systemd.packages = [ pkgs.borgmatic ];

     

       
182
       
 
       
      systemd.services.borgmatic.path = [ pkgs.coreutils ];

     

       
183
       
+
       
      systemd.services.borgmatic.serviceConfig = lib.optionalAttrs anycfgRequiresSudo {

     

       
184
       
+
       
        NoNewPrivileges = false;

     

       
185
       
+
       
        CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_NET_RAW CAP_SETUID CAP_SETGID";

     

       
186
       
+
       
      };

     

       
187
       
 
       


     

       
188
       
 
       
      # Workaround: https://github.com/NixOS/nixpkgs/issues/81138

     

       
189
       
 
       
      systemd.timers.borgmatic.wantedBy = [ "timers.target" ];