150 lines
4.5 KiB
Nix
150 lines
4.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
forEachInstance = f: flip mapAttrs' config.services.fcgiwrap.instances (
|
|
name: cfg: nameValuePair "fcgiwrap-${name}" (f cfg)
|
|
);
|
|
|
|
in {
|
|
imports = forEach [
|
|
"enable"
|
|
"user"
|
|
"group"
|
|
"socketType"
|
|
"socketAddress"
|
|
"preforkProcesses"
|
|
] (attr: mkRemovedOptionModule [ "services" "fcgiwrap" attr ] ''
|
|
The global shared fcgiwrap instance is no longer supported due to
|
|
security issues.
|
|
Isolated instances should instead be configured through
|
|
`services.fcgiwrap.instances.*'.
|
|
'');
|
|
|
|
options.services.fcgiwrap.instances = mkOption {
|
|
description = "Configuration for fcgiwrap instances.";
|
|
default = { };
|
|
type = types.attrsOf (types.submodule ({ config, ... }: { options = {
|
|
process.prefork = mkOption {
|
|
type = types.ints.positive;
|
|
default = 1;
|
|
description = "Number of processes to prefork.";
|
|
};
|
|
|
|
process.user = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
User as which this instance of fcgiwrap will be run.
|
|
Set to `null` (the default) to use a dynamically allocated user.
|
|
'';
|
|
};
|
|
|
|
process.group = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = "Group as which this instance of fcgiwrap will be run.";
|
|
};
|
|
|
|
socket.type = mkOption {
|
|
type = types.enum [ "unix" "tcp" "tcp6" ];
|
|
default = "unix";
|
|
description = "Socket type: 'unix', 'tcp' or 'tcp6'.";
|
|
};
|
|
|
|
socket.address = mkOption {
|
|
type = types.str;
|
|
default = "/run/fcgiwrap-${config._module.args.name}.sock";
|
|
example = "1.2.3.4:5678";
|
|
description = ''
|
|
Socket address.
|
|
In case of a UNIX socket, this should be its filesystem path.
|
|
'';
|
|
};
|
|
|
|
socket.user = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
User to be set as owner of the UNIX socket.
|
|
'';
|
|
};
|
|
|
|
socket.group = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
Group to be set as owner of the UNIX socket.
|
|
'';
|
|
};
|
|
|
|
socket.mode = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = if config.socket.type == "unix" then "0600" else null;
|
|
defaultText = literalExpression ''
|
|
if config.socket.type == "unix" then "0600" else null
|
|
'';
|
|
description = ''
|
|
Mode to be set on the UNIX socket.
|
|
Defaults to private to the socket's owner.
|
|
'';
|
|
};
|
|
}; }));
|
|
};
|
|
|
|
config = {
|
|
assertions = concatLists (mapAttrsToList (name: cfg: [
|
|
{
|
|
assertion = cfg.socket.type == "unix" -> cfg.socket.user != null;
|
|
message = "Socket owner is required for the UNIX socket type.";
|
|
}
|
|
{
|
|
assertion = cfg.socket.type == "unix" -> cfg.socket.group != null;
|
|
message = "Socket owner is required for the UNIX socket type.";
|
|
}
|
|
{
|
|
assertion = cfg.socket.user != null -> cfg.socket.type == "unix";
|
|
message = "Socket owner can only be set for the UNIX socket type.";
|
|
}
|
|
{
|
|
assertion = cfg.socket.group != null -> cfg.socket.type == "unix";
|
|
message = "Socket owner can only be set for the UNIX socket type.";
|
|
}
|
|
{
|
|
assertion = cfg.socket.mode != null -> cfg.socket.type == "unix";
|
|
message = "Socket mode can only be set for the UNIX socket type.";
|
|
}
|
|
]) config.services.fcgiwrap.instances);
|
|
|
|
systemd.services = forEachInstance (cfg: {
|
|
after = [ "nss-user-lookup.target" ];
|
|
wantedBy = optional (cfg.socket.type != "unix") "multi-user.target";
|
|
|
|
serviceConfig = {
|
|
ExecStart = ''
|
|
${pkgs.fcgiwrap}/sbin/fcgiwrap ${cli.toGNUCommandLineShell {} ({
|
|
c = cfg.process.prefork;
|
|
} // (optionalAttrs (cfg.socket.type != "unix") {
|
|
s = "${cfg.socket.type}:${cfg.socket.address}";
|
|
}))}
|
|
'';
|
|
} // (if cfg.process.user != null then {
|
|
User = cfg.process.user;
|
|
Group = cfg.process.group;
|
|
} else {
|
|
DynamicUser = true;
|
|
});
|
|
});
|
|
|
|
systemd.sockets = forEachInstance (cfg: mkIf (cfg.socket.type == "unix") {
|
|
wantedBy = [ "sockets.target" ];
|
|
socketConfig = {
|
|
ListenStream = cfg.socket.address;
|
|
SocketUser = cfg.socket.user;
|
|
SocketGroup = cfg.socket.group;
|
|
SocketMode = cfg.socket.mode;
|
|
};
|
|
});
|
|
};
|
|
}
|