BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

knot: drop dynamic user

Browse source 
This makes it hard to include secret files.
Also using tools like keymgr becomes harder.
This commit is contained in:
Jörg Thalheim 2020-02-12 16:34:10 +00:00
parent 6adc09ed30
commit 88029bce39
No known key found for this signature in database
GPG key ID: 003F2096411B5F92
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
nixos/modules/services/networking/knot.nix
View file

@ -65,6 +65,13 @@ in {
};
config = mkIf config.services.knot.enable {
users.users.knot = {
isSystemUser = true;
group = "knot";
description = "Knot daemon user";
};
users.groups.knot.gid = null;
systemd.services.knot = {
unitConfig.Documentation = "man:knotd(8) man:knot.conf(5) man:knotc(8) https://www.knot-dns.cz/docs/${cfg.package.version}/html/";
description = cfg.package.meta.description;
@ -79,7 +86,7 @@ in {
CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
NoNewPrivileges = true;
DynamicUser = "yes";
User = "knot";
RuntimeDirectory = "knot";
StateDirectory = "knot";
StateDirectoryMode = "0700";