about summary refs log tree commit diff
path: root/nixos
diff options
context:
space:
mode:
authorJoachim Fasting <joachifm@fastmail.fm>2016-09-01 18:48:13 +0200
committerJoachim Fasting <joachifm@fastmail.fm>2016-09-15 15:37:19 +0200
commit39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89 (patch)
treec03956cd96494de14afac5d20133733300dbf896 /nixos
parent0759e77dfd1d9272a2a26390b5a2cb8fb80efc3c (diff)
downloadnixlib-39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89.tar
nixlib-39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89.tar.gz
nixlib-39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89.tar.bz2
nixlib-39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89.tar.lz
nixlib-39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89.tar.xz
nixlib-39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89.tar.zst
nixlib-39f5182a30cd9eec3ce5bbf30fd1d5ae04126d89.zip
unbound service: use auto-generated uid
1. The preStart script ensures consistent ownership, even if the unbound
   user's uid has changed
2. The unbound daemon does not generate data that needs to be private to
   it, so it would not matter that a different service would end up
   owning its data (as long as unbound remains enabled, it should reclaim
   ownership soon enough anyway).

Thus, there's no clear benefit to allocate a dedicated uid for the
unbound service.  This releases uid/gid 48.

Also, because the preStart script creates the data directory, there's no
need to specify a homedir or ask for its creation.
Diffstat (limited to 'nixos')
-rw-r--r--nixos/modules/services/networking/unbound.nix7
1 files changed, 2 insertions, 5 deletions
diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index 304996c6326f..c7a4eb6060c0 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -96,12 +96,9 @@ in
 
     environment.systemPackages = [ pkgs.unbound ];
 
-    users.extraUsers = singleton {
-      name = "unbound";
-      uid = config.ids.uids.unbound;
+    users.users.unbound = {
       description = "unbound daemon user";
-      home = stateDir;
-      createHome = true;
+      isSystemUser = true;
     };
 
     systemd.services.unbound = {