Unverified Commit 13aff9b3 authored by pennae's avatar pennae Committed by GitHub
Browse files

Merge pull request #259937 from charmoniumQ/patch-1 

nixos/mosquitto: fix ACL permissions
parents 4082c124 14ffe0e2

nixos/modules/services/networking/mosquitto.nix

+22 −12
Original line number Diff line number Diff line
@@ -177,17 +177,6 @@ let 
           ''

           ++ hashedLines));



  makeACLFile = idx: users: supplement:

    pkgs.writeText "mosquitto-acl-${toString idx}.conf"

      (concatStringsSep

        "\n"

        (flatten [

          supplement

          (mapAttrsToList

            (n: u: [ "user ${n}" ] ++ map (t: "topic ${t}") u.acl)

            users)

        ]));



  authPluginOptions = with types; submodule {

    options = {

      plugin = mkOption {
@@ -342,7 +331,7 @@ let 
  formatListener = idx: listener:

    [

      "listener ${toString listener.port} ${toString listener.address}"

      "acl_file ${makeACLFile idx listener.users listener.acl}"

      "acl_file /etc/mosquitto/mosquitto-acl-${toString idx}.conf"

    ]

    ++ optional (! listener.omitPasswordAuth) "password_file ${cfg.dataDir}/passwd-${toString idx}"

    ++ formatFreeform {} listener.settings
@@ -698,6 +687,27 @@ in 
            cfg.listeners);

    };



    environment.etc = listToAttrs (

      imap0

        (idx: listener: {

          name = "mosquitto/mosquitto-acl-${toString idx}.conf";

          value = {

            user = config.users.users.mosquitto.name;

            group = config.users.users.mosquitto.group;

            mode = "0400";

            text = (concatStringsSep

              "\n"

              (flatten [

                listener.acl

                (mapAttrsToList

                  (n: u: [ "user ${n}" ] ++ map (t: "topic ${t}") u.acl)

                  listener.users)

              ]));

          };

        })

        cfg.listeners

    );



    users.users.mosquitto = {

      description = "Mosquitto MQTT Broker Daemon owner";

      group = "mosquitto";