nixos/ntfy-sh: add defaults, use dynamic user

1 files changed, 11 insertions, 24 deletions

diff --git a/nixos/modules/services/misc/ntfy-sh.nix b/nixos/modules/services/misc/ntfy-sh.nix
index d66b47a2d68a..3dc3bd616c09 100644
--- a/nixos/modules/services/misc/ntfy-sh.nix
+++ b/nixos/modules/services/misc/ntfy-sh.nix
@@ -19,18 +19,6 @@ in
       description = mdDoc "The ntfy.sh package to use.";
     };
 
-    user = mkOption {
-      default = "ntfy-sh";
-      type = types.str;
-      description = lib.mdDoc "User the ntfy-sh server runs under.";
-    };
-
-    group = mkOption {
-      default = "ntfy-sh";
-      type = types.str;
-      description = lib.mdDoc "Primary group of ntfy-sh user.";
-    };
-
     settings = mkOption {
       type = types.submodule { freeformType = settingsFormat.type; };
 
@@ -61,6 +49,9 @@ in
 
       services.ntfy-sh.settings = {
         auth-file = mkDefault "/var/lib/ntfy-sh/user.db";
+        listen-http = mkDefault "127.0.0.1:2586";
+        attachment-cache-dir = mkDefault "/var/lib/ntfy-sh/attachments";
+        cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
       };
 
       systemd.services.ntfy-sh = {
@@ -70,10 +61,15 @@ in
         after = [ "network.target" ];
 
         serviceConfig = {
+          ExecStartPre = [
+            "${pkgs.coreutils}/bin/touch ${cfg.settings.auth-file}"
+            "${pkgs.coreutils}/bin/mkdir -p ${cfg.settings.attachment-cache-dir}"
+            "${pkgs.coreutils}/bin/touch ${cfg.settings.cache-file}"
+          ];
           ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";
-          User = cfg.user;
           StateDirectory = "ntfy-sh";
 
+          DynamicUser = true;
           AmbientCapabilities = "CAP_NET_BIND_SERVICE";
           PrivateTmp = true;
           NoNewPrivileges = true;
@@ -88,17 +84,8 @@ in
           RestrictNamespaces = true;
           RestrictRealtime = true;
           MemoryDenyWriteExecute = true;
-        };
-      };
-
-      users.groups = optionalAttrs (cfg.group == "ntfy-sh") {
-        ntfy-sh = { };
-      };
-
-      users.users = optionalAttrs (cfg.user == "ntfy-sh") {
-        ntfy-sh = {
-          isSystemUser = true;
-          group = cfg.group;
+          # Upstream Requirements
+          LimitNOFILE = 20500;
         };
       };
     };