170 lines
4.4 KiB
Nix
170 lines
4.4 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.services.fcron;
|
|
|
|
queuelen = optionalString (cfg.queuelen != null) "-q ${toString cfg.queuelen}";
|
|
|
|
# Duplicate code, also found in cron.nix. Needs deduplication.
|
|
systemCronJobs =
|
|
''
|
|
SHELL=${pkgs.bash}/bin/bash
|
|
PATH=${config.system.path}/bin:${config.system.path}/sbin
|
|
${optionalString (config.services.cron.mailto != null) ''
|
|
MAILTO="${config.services.cron.mailto}"
|
|
''}
|
|
NIX_CONF_DIR=/etc/nix
|
|
${lib.concatStrings (map (job: job + "\n") config.services.cron.systemCronJobs)}
|
|
'';
|
|
|
|
allowdeny = target: users:
|
|
{ source = pkgs.writeText "fcron.${target}" (concatStringsSep "\n" users);
|
|
target = "fcron.${target}";
|
|
mode = "644";
|
|
gid = config.ids.gids.fcron;
|
|
};
|
|
|
|
in
|
|
|
|
{
|
|
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
services.fcron = {
|
|
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Whether to enable the {command}`fcron` daemon.";
|
|
};
|
|
|
|
allow = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ "all" ];
|
|
description = ''
|
|
Users allowed to use fcrontab and fcrondyn (one name per
|
|
line, `all` for everyone).
|
|
'';
|
|
};
|
|
|
|
deny = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = "Users forbidden from using fcron.";
|
|
};
|
|
|
|
maxSerialJobs = mkOption {
|
|
type = types.int;
|
|
default = 1;
|
|
description = "Maximum number of serial jobs which can run simultaneously.";
|
|
};
|
|
|
|
queuelen = mkOption {
|
|
type = types.nullOr types.int;
|
|
default = null;
|
|
description = "Number of jobs the serial queue and the lavg queue can contain.";
|
|
};
|
|
|
|
systab = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
description = ''The "system" crontab contents.'';
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
services.fcron.systab = systemCronJobs;
|
|
|
|
environment.etc = listToAttrs
|
|
(map (x: { name = x.target; value = x; })
|
|
[ (allowdeny "allow" (cfg.allow))
|
|
(allowdeny "deny" cfg.deny)
|
|
# see man 5 fcron.conf
|
|
{ source =
|
|
let
|
|
isSendmailWrapped =
|
|
lib.hasAttr "sendmail" config.security.wrappers;
|
|
sendmailPath =
|
|
if isSendmailWrapped then "/run/wrappers/bin/sendmail"
|
|
else "${config.system.path}/bin/sendmail";
|
|
in
|
|
pkgs.writeText "fcron.conf" ''
|
|
fcrontabs = /var/spool/fcron
|
|
pidfile = /run/fcron.pid
|
|
fifofile = /run/fcron.fifo
|
|
fcronallow = /etc/fcron.allow
|
|
fcrondeny = /etc/fcron.deny
|
|
shell = /bin/sh
|
|
sendmail = ${sendmailPath}
|
|
editor = ${pkgs.vim}/bin/vim
|
|
'';
|
|
target = "fcron.conf";
|
|
gid = config.ids.gids.fcron;
|
|
mode = "0644";
|
|
}
|
|
]);
|
|
|
|
environment.systemPackages = [ pkgs.fcron ];
|
|
users.users.fcron = {
|
|
uid = config.ids.uids.fcron;
|
|
home = "/var/spool/fcron";
|
|
group = "fcron";
|
|
};
|
|
users.groups.fcron.gid = config.ids.gids.fcron;
|
|
|
|
security.wrappers = {
|
|
fcrontab = {
|
|
source = "${pkgs.fcron}/bin/fcrontab";
|
|
owner = "fcron";
|
|
group = "fcron";
|
|
setgid = true;
|
|
setuid = true;
|
|
};
|
|
fcrondyn = {
|
|
source = "${pkgs.fcron}/bin/fcrondyn";
|
|
owner = "fcron";
|
|
group = "fcron";
|
|
setgid = true;
|
|
setuid = false;
|
|
};
|
|
fcronsighup = {
|
|
source = "${pkgs.fcron}/bin/fcronsighup";
|
|
owner = "root";
|
|
group = "fcron";
|
|
setuid = true;
|
|
};
|
|
};
|
|
systemd.services.fcron = {
|
|
description = "fcron daemon";
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
path = [ pkgs.fcron ];
|
|
|
|
preStart = ''
|
|
install \
|
|
--mode 0770 \
|
|
--owner fcron \
|
|
--group fcron \
|
|
--directory /var/spool/fcron
|
|
# load system crontab file
|
|
/run/wrappers/bin/fcrontab -u systab - < ${pkgs.writeText "systab" cfg.systab}
|
|
'';
|
|
|
|
serviceConfig = {
|
|
Type = "forking";
|
|
ExecStart = "${pkgs.fcron}/sbin/fcron -m ${toString cfg.maxSerialJobs} ${queuelen}";
|
|
};
|
|
};
|
|
};
|
|
}
|