Commit 3dcca62a authored by happysalada's avatar happysalada Committed by Yt
Browse files

nixos/ntfy-sh: add defaults, use dynamic user

parent 4a04b823

nixos/modules/services/misc/ntfy-sh.nix

+11 −24
Original line number Diff line number Diff line
@@ -19,18 +19,6 @@ in 
      description = mdDoc "The ntfy.sh package to use.";

    };



    user = mkOption {

      default = "ntfy-sh";

      type = types.str;

      description = lib.mdDoc "User the ntfy-sh server runs under.";

    };



    group = mkOption {

      default = "ntfy-sh";

      type = types.str;

      description = lib.mdDoc "Primary group of ntfy-sh user.";

    };



    settings = mkOption {

      type = types.submodule { freeformType = settingsFormat.type; };
@@ -61,6 +49,9 @@ in 


      services.ntfy-sh.settings = {

        auth-file = mkDefault "/var/lib/ntfy-sh/user.db";

        listen-http = mkDefault "127.0.0.1:2586";

        attachment-cache-dir = mkDefault "/var/lib/ntfy-sh/attachments";

        cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";

      };



      systemd.services.ntfy-sh = {
@@ -70,10 +61,15 @@ in 
        after = [ "network.target" ];



        serviceConfig = {

          ExecStartPre = [

            "${pkgs.coreutils}/bin/touch ${cfg.settings.auth-file}"

            "${pkgs.coreutils}/bin/mkdir -p ${cfg.settings.attachment-cache-dir}"

            "${pkgs.coreutils}/bin/touch ${cfg.settings.cache-file}"

          ];

          ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";

          User = cfg.user;

          StateDirectory = "ntfy-sh";



          DynamicUser = true;

          AmbientCapabilities = "CAP_NET_BIND_SERVICE";

          PrivateTmp = true;

          NoNewPrivileges = true;
@@ -88,17 +84,8 @@ in 
          RestrictNamespaces = true;

          RestrictRealtime = true;

          MemoryDenyWriteExecute = true;

        };

      };



      users.groups = optionalAttrs (cfg.group == "ntfy-sh") {

        ntfy-sh = { };

      };



      users.users = optionalAttrs (cfg.user == "ntfy-sh") {

        ntfy-sh = {

          isSystemUser = true;

          group = cfg.group;

          # Upstream Requirements

          LimitNOFILE = 20500;

        };

      };

    };

nixos/tests/ntfy-sh.nix

+2 −0
Original line number Diff line number Diff line
@@ -19,5 +19,7 @@ import ./make-test-python.nix { 
    notif = json.loads(machine.succeed("curl -s localhost:80/test/json?poll=1"))



    assert msg == notif["message"], "Wrong message"



    machine.succeed("ntfy user list")

  '';

}