diff options
author | Jörg Thalheim <joerg@thalheim.io> | 2018-01-03 12:10:45 +0100 |
---|---|---|
committer | Jörg Thalheim <joerg@thalheim.io> | 2018-01-03 12:33:36 +0100 |
commit | c9c8a2c5b3b72668656add5409853db8e15ea99d (patch) | |
tree | 0aa282eca08700f8ac99bc5a56a1dcbd3249b774 /nixos/modules/services/databases | |
parent | eb6db32d015397f24bd623a60e7e53e37ffe2258 (diff) | |
download | nixlib-c9c8a2c5b3b72668656add5409853db8e15ea99d.tar nixlib-c9c8a2c5b3b72668656add5409853db8e15ea99d.tar.gz nixlib-c9c8a2c5b3b72668656add5409853db8e15ea99d.tar.bz2 nixlib-c9c8a2c5b3b72668656add5409853db8e15ea99d.tar.lz nixlib-c9c8a2c5b3b72668656add5409853db8e15ea99d.tar.xz nixlib-c9c8a2c5b3b72668656add5409853db8e15ea99d.tar.zst nixlib-c9c8a2c5b3b72668656add5409853db8e15ea99d.zip |
nixos/memcached: make unix sockets usuable
before: - /var/run/memcached is a bad default for a socket path, since its parent directory must be writeable by memcached. - Socket directory was not created by the module itself -> this was left as a burden to the user? - Having a static uid with a dynamic user name is not very useful. after: - Replace services.memcached.socket by a boolean flag. This simplifies our code, since we do not have to check if the user specifies a path with a parent directory that should be owned by memcached (/run/memcached/memcached.sock -> /run/memcached). - Remove fixed uid/gid allocation. The only file ever owned by the daemon is the socket that will be recreated on every start. Therefore user and group ids do not need to be static. - only create the memcached user, if the user has not specified a different one. The major use case for changing option is to allow existing services (such as php-fpm) opening the local unix socket. If we would unconditionally create a user that option would be useless.
Diffstat (limited to 'nixos/modules/services/databases')
-rw-r--r-- | nixos/modules/services/databases/memcached.nix | 57 |
1 files changed, 31 insertions, 26 deletions
diff --git a/nixos/modules/services/databases/memcached.nix b/nixos/modules/services/databases/memcached.nix index c6875af506d3..46bc6fc5c132 100644 --- a/nixos/modules/services/databases/memcached.nix +++ b/nixos/modules/services/databases/memcached.nix @@ -40,11 +40,7 @@ in description = "The port to bind to"; }; - socket = mkOption { - default = ""; - description = "Unix socket path to listen on. Setting this will disable network support"; - example = "/var/run/memcached"; - }; + enableUnixSocket = mkEnableOption "unix socket at /run/memcached/memcached.sock"; maxMemory = mkOption { default = 64; @@ -68,31 +64,40 @@ in config = mkIf config.services.memcached.enable { - users.extraUsers.memcached = - { name = cfg.user; - uid = config.ids.uids.memcached; - description = "Memcached server user"; - }; + users.extraUsers = optional (cfg.user == "memcached") { + name = "memcached"; + description = "Memcached server user"; + }; environment.systemPackages = [ memcached ]; - systemd.services.memcached = - { description = "Memcached server"; - - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - - serviceConfig = { - ExecStart = - let - networking = if cfg.socket != "" - then "-s ${cfg.socket}" - else "-l ${cfg.listen} -p ${toString cfg.port}"; - in "${memcached}/bin/memcached ${networking} -m ${toString cfg.maxMemory} -c ${toString cfg.maxConnections} ${concatStringsSep " " cfg.extraOptions}"; - - User = cfg.user; - }; + systemd.services.memcached = { + description = "Memcached server"; + + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + serviceConfig = { + PermissionsStartOnly = true; + ExecStartPre = optionals cfg.enableUnixSocket [ + "${pkgs.coreutils}/bin/install -d -o ${cfg.user} /run/memcached/" + "${pkgs.coreutils}/bin/chown -R ${cfg.user} /run/memcached/" + ]; + ExecStart = + let + networking = if cfg.enableUnixSocket + then "-s /run/memcached/memcached.sock" + else "-l ${cfg.listen} -p ${toString cfg.port}"; + in "${memcached}/bin/memcached ${networking} -m ${toString cfg.maxMemory} -c ${toString cfg.maxConnections} ${concatStringsSep " " cfg.extraOptions}"; + + User = cfg.user; }; + }; }; + imports = [ + (mkRemovedOptionModule ["services" "memcached" "socket"] '' + This option was replaced by a fixed unix socket path at /run/memcached/memcached.sock enabled using services.memached.enableUnixSocket. + '') + ]; } |