forked from mirrors/nixpkgs
nixos: define the primary group of users where needed
This commit is contained in:
Guillaume Girol
parent
0f15a8f489
commit
bc3bca822a
|
|
@ -83,14 +83,14 @@ in
|
|||
#fourstore = 42; # dropped in 20.03
|
||||
#fourstorehttp = 43; # dropped in 20.03
|
||||
virtuoso = 44;
|
||||
rtkit = 45;
|
||||
#rtkit = 45; # dynamically allocated 2021-09-03
|
||||
dovecot2 = 46;
|
||||
dovenull2 = 47;
|
||||
prayer = 49;
|
||||
mpd = 50;
|
||||
clamav = 51;
|
||||
fprot = 52;
|
||||
bind = 53;
|
||||
# bind = 53; #dynamically allocated as of 2021-09-03
|
||||
wwwrun = 54;
|
||||
#adm = 55; # unused
|
||||
spamd = 56;
|
||||
|
|
@ -134,13 +134,13 @@ in
|
|||
firebird = 95;
|
||||
#keys = 96; # unused
|
||||
#haproxy = 97; # dynamically allocated as of 2020-03-11
|
||||
mongodb = 98;
|
||||
#mongodb = 98; #dynamically allocated as of 2021-09-03
|
||||
#openldap = 99; # dynamically allocated as of PR#94610
|
||||
#users = 100; # unused
|
||||
cgminer = 101;
|
||||
munin = 102;
|
||||
logcheck = 103;
|
||||
nix-ssh = 104;
|
||||
#nix-ssh = 104; #dynamically allocated as of 2021-09-03
|
||||
dictd = 105;
|
||||
couchdb = 106;
|
||||
#searx = 107; # dynamically allocated as of 2020-10-27
|
||||
|
|
@ -149,9 +149,9 @@ in
|
|||
systemd-journal-gateway = 110;
|
||||
#notbit = 111; # unused
|
||||
aerospike = 111;
|
||||
ngircd = 112;
|
||||
#ngircd = 112; #dynamically allocated as of 2021-09-03
|
||||
#btsync = 113; # unused
|
||||
minecraft = 114;
|
||||
#minecraft = 114; #dynamically allocated as of 2021-09-03
|
||||
vault = 115;
|
||||
rippled = 116;
|
||||
murmur = 117;
|
||||
|
|
@ -169,19 +169,19 @@ in
|
|||
mopidy = 130;
|
||||
#docker = 131; # unused
|
||||
gdm = 132;
|
||||
dhcpd = 133;
|
||||
#dhcpd = 133; # dynamically allocated as of 2021-09-03
|
||||
siproxd = 134;
|
||||
mlmmj = 135;
|
||||
neo4j = 136;
|
||||
#neo4j = 136;# dynamically allocated as of 2021-09-03
|
||||
riemann = 137;
|
||||
riemanndash = 138;
|
||||
radvd = 139;
|
||||
zookeeper = 140;
|
||||
dnsmasq = 141;
|
||||
#radvd = 139;# dynamically allocated as of 2021-09-03
|
||||
#zookeeper = 140;# dynamically allocated as of 2021-09-03
|
||||
#dnsmasq = 141;# dynamically allocated as of 2021-09-03
|
||||
#uhub = 142; # unused
|
||||
yandexdisk = 143;
|
||||
mxisd = 144; # was once collectd
|
||||
consul = 145;
|
||||
#consul = 145;# dynamically allocated as of 2021-09-03
|
||||
mailpile = 146;
|
||||
redmine = 147;
|
||||
#seeks = 148; # removed 2020-06-21
|
||||
|
|
@ -192,7 +192,7 @@ in
|
|||
systemd-resolve = 153;
|
||||
systemd-timesync = 154;
|
||||
liquidsoap = 155;
|
||||
etcd = 156;
|
||||
#etcd = 156;# dynamically allocated as of 2021-09-03
|
||||
hbase = 158;
|
||||
opentsdb = 159;
|
||||
scollector = 160;
|
||||
|
|
@ -204,7 +204,7 @@ in
|
|||
tox-bootstrapd = 166;
|
||||
cadvisor = 167;
|
||||
nylon = 168;
|
||||
apache-kafka = 169;
|
||||
#apache-kafka = 169;# dynamically allocated as of 2021-09-03
|
||||
#panamax = 170; # unused
|
||||
exim = 172;
|
||||
#fleet = 173; # unused
|
||||
|
|
@ -241,7 +241,7 @@ in
|
|||
gateone = 207;
|
||||
namecoin = 208;
|
||||
#lxd = 210; # unused
|
||||
kibana = 211;
|
||||
#kibana = 211;# dynamically allocated as of 2021-09-03
|
||||
xtreemfs = 212;
|
||||
calibre-server = 213;
|
||||
heapster = 214;
|
||||
|
|
@ -264,7 +264,7 @@ in
|
|||
avahi-autoipd = 231;
|
||||
nntp-proxy = 232;
|
||||
mjpg-streamer = 233;
|
||||
radicale = 234;
|
||||
#radicale = 234;# dynamically allocated as of 2021-09-03
|
||||
hydra-queue-runner = 235;
|
||||
hydra-www = 236;
|
||||
syncthing = 237;
|
||||
|
|
@ -272,14 +272,14 @@ in
|
|||
taskd = 240;
|
||||
# factorio = 241; # DynamicUser = true
|
||||
# emby = 242; # unusued, removed 2019-05-01
|
||||
graylog = 243;
|
||||
#graylog = 243;# dynamically allocated as of 2021-09-03
|
||||
sniproxy = 244;
|
||||
nzbget = 245;
|
||||
mosquitto = 246;
|
||||
toxvpn = 247;
|
||||
# squeezelite = 248; # DynamicUser = true
|
||||
turnserver = 249;
|
||||
smokeping = 250;
|
||||
#smokeping = 250;# dynamically allocated as of 2021-09-03
|
||||
gocd-agent = 251;
|
||||
gocd-server = 252;
|
||||
terraria = 253;
|
||||
|
|
@ -553,7 +553,7 @@ in
|
|||
#shout = 206; #unused
|
||||
gateone = 207;
|
||||
namecoin = 208;
|
||||
lxd = 210; # unused
|
||||
#lxd = 210; # unused
|
||||
#kibana = 211;
|
||||
xtreemfs = 212;
|
||||
calibre-server = 213;
|
||||
|
|
@ -572,7 +572,7 @@ in
|
|||
cfdyndns = 227;
|
||||
pdnsd = 229;
|
||||
octoprint = 230;
|
||||
radicale = 234;
|
||||
#radicale = 234;# dynamically allocated as of 2021-09-03
|
||||
syncthing = 237;
|
||||
caddy = 239;
|
||||
taskd = 240;
|
||||
|
|
@ -584,7 +584,7 @@ in
|
|||
#toxvpn = 247; # unused
|
||||
#squeezelite = 248; #unused
|
||||
turnserver = 249;
|
||||
smokeping = 250;
|
||||
#smokeping = 250;# dynamically allocated as of 2021-09-03
|
||||
gocd-agent = 251;
|
||||
gocd-server = 252;
|
||||
terraria = 253;
|
||||
|
|
|
|||
|
|
@ -35,9 +35,12 @@ with lib;
|
|||
services.dbus.packages = [ pkgs.rtkit ];
|
||||
|
||||
users.users.rtkit =
|
||||
{ uid = config.ids.uids.rtkit;
|
||||
{
|
||||
isSystemUser = true;
|
||||
group = "rtkit";
|
||||
description = "RealtimeKit daemon";
|
||||
};
|
||||
users.groups.rtkit = {};
|
||||
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -169,6 +169,7 @@ let
|
|||
(map (mkAuthorizedKey cfg false) cfg.authorizedKeys
|
||||
++ map (mkAuthorizedKey cfg true) cfg.authorizedKeysAppendOnly);
|
||||
useDefaultShell = true;
|
||||
group = cfg.group;
|
||||
isSystemUser = true;
|
||||
};
|
||||
groups.${cfg.group} = { };
|
||||
|
|
|
|||
|
|
@ -185,6 +185,7 @@ in
|
|||
users.users = optionalAttrs (cfg.user == "influxdb") {
|
||||
influxdb = {
|
||||
uid = config.ids.uids.influxdb;
|
||||
group = "influxdb";
|
||||
description = "Influxdb daemon user";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -67,7 +67,9 @@ in
|
|||
users.users = optionalAttrs (cfg.user == "memcached") {
|
||||
memcached.description = "Memcached server user";
|
||||
memcached.isSystemUser = true;
|
||||
memcached.group = "memcached";
|
||||
};
|
||||
users.groups = optionalAttrs (cfg.user == "memcached") { memcached = {}; };
|
||||
|
||||
environment.systemPackages = [ memcached ];
|
||||
|
||||
|
|
|
|||
|
|
@ -123,9 +123,11 @@ in
|
|||
|
||||
users.users.mongodb = mkIf (cfg.user == "mongodb")
|
||||
{ name = "mongodb";
|
||||
uid = config.ids.uids.mongodb;
|
||||
isSystemUser = true;
|
||||
group = "mongodb";
|
||||
description = "MongoDB server user";
|
||||
};
|
||||
users.groups.mongodb = mkIf (cfg.user == "mongodb") {};
|
||||
|
||||
environment.systemPackages = [ mongodb ];
|
||||
|
||||
|
|
|
|||
|
|
@ -651,10 +651,12 @@ in {
|
|||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
users.users.neo4j = {
|
||||
uid = config.ids.uids.neo4j;
|
||||
isSystemUser = true;
|
||||
group = "neo4j";
|
||||
description = "Neo4j daemon user";
|
||||
home = cfg.directories.home;
|
||||
};
|
||||
users.groups.neo4j = {};
|
||||
};
|
||||
|
||||
meta = {
|
||||
|
|
|
|||
|
|
@ -246,6 +246,7 @@ in {
|
|||
|
||||
users.users.redis = {
|
||||
description = "Redis database user";
|
||||
group = "redis";
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.redis = {};
|
||||
|
|
|
|||
|
|
@ -167,8 +167,10 @@ in {
|
|||
description = "Minecraft server service user";
|
||||
home = cfg.dataDir;
|
||||
createHome = true;
|
||||
uid = config.ids.uids.minecraft;
|
||||
isSystemUser = true;
|
||||
group = "minecraft";
|
||||
};
|
||||
users.groups.minecraft = {};
|
||||
|
||||
systemd.services.minecraft-server = {
|
||||
description = "Minecraft Server Service";
|
||||
|
|
|
|||
|
|
@ -128,10 +128,12 @@ in
|
|||
|
||||
users.users = mkIf (cfg.user == "graylog") {
|
||||
graylog = {
|
||||
uid = config.ids.uids.graylog;
|
||||
isSystemUser = true;
|
||||
group = "graylog";
|
||||
description = "Graylog server daemon user";
|
||||
};
|
||||
};
|
||||
users.groups = mkIf (cfg.user == "graylog") {};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${cfg.messageJournalDir}' - ${cfg.user} - - -"
|
||||
|
|
|
|||
|
|
@ -165,10 +165,12 @@ in {
|
|||
|
||||
users.users.airsonic = {
|
||||
description = "Airsonic service user";
|
||||
group = "airsonic";
|
||||
name = cfg.user;
|
||||
home = cfg.home;
|
||||
createHome = true;
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.airsonic = {};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -120,10 +120,12 @@ in {
|
|||
environment.systemPackages = [cfg.package];
|
||||
|
||||
users.users.apache-kafka = {
|
||||
uid = config.ids.uids.apache-kafka;
|
||||
isSystemUser = true;
|
||||
group = "apache-kafka";
|
||||
description = "Apache Kafka daemon user";
|
||||
home = head cfg.logDirs;
|
||||
};
|
||||
users.groups.apache-kafka = {};
|
||||
|
||||
systemd.tmpfiles.rules = map (logDir: "d '${logDir}' 0700 apache-kafka - - -") cfg.logDirs;
|
||||
|
||||
|
|
|
|||
|
|
@ -151,7 +151,9 @@ in {
|
|||
home = cfg.storagePath;
|
||||
}
|
||||
else {}) // {
|
||||
group = "docker-registry";
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.docker-registry = {};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -187,9 +187,11 @@ in {
|
|||
environment.systemPackages = [ pkgs.etcd ];
|
||||
|
||||
users.users.etcd = {
|
||||
uid = config.ids.uids.etcd;
|
||||
isSystemUser = true;
|
||||
group = "etcd";
|
||||
description = "Etcd daemon user";
|
||||
home = cfg.dataDir;
|
||||
};
|
||||
users.groups.etcd = {};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -38,9 +38,11 @@ in {
|
|||
|
||||
users.users.nix-ssh = {
|
||||
description = "Nix SSH store user";
|
||||
uid = config.ids.uids.nix-ssh;
|
||||
isSystemUser = true;
|
||||
group = "nix-ssh";
|
||||
useDefaultShell = true;
|
||||
};
|
||||
users.groups.nix-ssh = {};
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
|
|
|
|||
|
|
@ -148,9 +148,11 @@ in {
|
|||
};
|
||||
|
||||
users.users.zookeeper = {
|
||||
uid = config.ids.uids.zookeeper;
|
||||
isSystemUser = true;
|
||||
group = "zookeeper";
|
||||
description = "Zookeeper daemon user";
|
||||
home = cfg.dataDir;
|
||||
};
|
||||
users.groups.zookeeper = {};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -561,6 +561,7 @@ in {
|
|||
) {
|
||||
users.users.graphite = {
|
||||
uid = config.ids.uids.graphite;
|
||||
group = "graphite";
|
||||
description = "Graphite daemon user";
|
||||
home = dataDir;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -258,6 +258,7 @@ in {
|
|||
|
||||
users.users = optionalAttrs (cfg.user == defaultUser) {
|
||||
${defaultUser} = {
|
||||
group = defaultUser;
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -36,6 +36,7 @@ in {
|
|||
groups._tuptime.members = [ "_tuptime" ];
|
||||
users._tuptime = {
|
||||
isSystemUser = true;
|
||||
group = "_tuptime";
|
||||
description = "tuptime database owner";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -193,7 +193,10 @@ in {
|
|||
environment.systemPackages = [ pkgs.orangefs ];
|
||||
|
||||
# orangefs daemon will run as user
|
||||
users.users.orangefs.isSystemUser = true;
|
||||
users.users.orangefs = {
|
||||
isSystemUser = true;
|
||||
group = "orangfs";
|
||||
};
|
||||
users.groups.orangefs = {};
|
||||
|
||||
# To format the file system the config file is needed.
|
||||
|
|
|
|||
|
|
@ -229,9 +229,11 @@ in
|
|||
|
||||
users.users.${bindUser} =
|
||||
{
|
||||
uid = config.ids.uids.bind;
|
||||
group = bindUser;
|
||||
description = "BIND daemon user";
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.${bindUser} = {};
|
||||
|
||||
systemd.services.bind = {
|
||||
description = "BIND Domain Name Server";
|
||||
|
|
|
|||
|
|
@ -159,10 +159,12 @@ in
|
|||
|
||||
users.users.consul = {
|
||||
description = "Consul agent daemon user";
|
||||
uid = config.ids.uids.consul;
|
||||
isSystemUser = true;
|
||||
group = "consul";
|
||||
# The shell is needed for health checks
|
||||
shell = "/run/current-system/sw/bin/bash";
|
||||
};
|
||||
users.groups.consul = {};
|
||||
|
||||
environment = {
|
||||
etc."consul.json".text = builtins.toJSON configOptions;
|
||||
|
|
|
|||
|
|
@ -311,6 +311,7 @@ in {
|
|||
{
|
||||
users.users.turnserver =
|
||||
{ uid = config.ids.uids.turnserver;
|
||||
group = "turnserver";
|
||||
description = "coturn TURN server user";
|
||||
};
|
||||
users.groups.turnserver =
|
||||
|
|
|
|||
|
|
@ -212,9 +212,11 @@ in
|
|||
|
||||
users = {
|
||||
users.dhcpd = {
|
||||
uid = config.ids.uids.dhcpd;
|
||||
isSystemUser = true;
|
||||
group = "dhcpd";
|
||||
description = "DHCP daemon user";
|
||||
};
|
||||
groups.dhcpd = {};
|
||||
};
|
||||
|
||||
systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;
|
||||
|
|
|
|||
|
|
@ -87,9 +87,11 @@ in
|
|||
services.dbus.packages = [ dnsmasq ];
|
||||
|
||||
users.users.dnsmasq = {
|
||||
uid = config.ids.uids.dnsmasq;
|
||||
isSystemUser = true;
|
||||
group = "dnsmasq";
|
||||
description = "Dnsmasq daemon user";
|
||||
};
|
||||
users.groups.dnsmasq = {};
|
||||
|
||||
networking.resolvconf = mkIf cfg.resolveLocalQueries {
|
||||
useLocalResolver = mkDefault true;
|
||||
|
|
|
|||
|
|
@ -107,6 +107,7 @@ in
|
|||
users.users = optionalAttrs (cfg.user == "git") {
|
||||
git = {
|
||||
uid = config.ids.uids.git;
|
||||
group = "git";
|
||||
description = "Git daemon user";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -190,6 +190,7 @@ in
|
|||
|
||||
users.users.${iodinedUser} = {
|
||||
uid = config.ids.uids.iodined;
|
||||
group = "iodined";
|
||||
description = "Iodine daemon user";
|
||||
};
|
||||
users.groups.iodined.gid = config.ids.gids.iodined;
|
||||
|
|
|
|||
|
|
@ -77,7 +77,9 @@ in
|
|||
createHome = true;
|
||||
home = "/var/lib/morty";
|
||||
isSystemUser = true;
|
||||
group = "morty";
|
||||
};
|
||||
users.groups.morty = {};
|
||||
|
||||
systemd.services.morty =
|
||||
{
|
||||
|
|
|
|||
|
|
@ -245,8 +245,10 @@ in
|
|||
|
||||
users.users.ncdns = {
|
||||
isSystemUser = true;
|
||||
group = "ncdns";
|
||||
description = "ncdns daemon user";
|
||||
};
|
||||
users.groups.ncdns = {};
|
||||
|
||||
systemd.services.ncdns = {
|
||||
description = "ncdns daemon";
|
||||
|
|
|
|||
|
|
@ -464,6 +464,7 @@ in {
|
|||
users.users = {
|
||||
nm-openvpn = {
|
||||
uid = config.ids.uids.nm-openvpn;
|
||||
group = "nm-openvpn";
|
||||
extraGroups = [ "networkmanager" ];
|
||||
};
|
||||
nm-iodine = {
|
||||
|
|
|
|||
|
|
@ -52,8 +52,11 @@ in {
|
|||
};
|
||||
|
||||
users.users.ngircd = {
|
||||
uid = config.ids.uids.ngircd;
|
||||
isSystemUser = true;
|
||||
group = "ngircd";
|
||||
description = "ngircd user.";
|
||||
};
|
||||
users.groups.ngircd = {};
|
||||
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -74,7 +74,7 @@ in {
|
|||
users."${cfg.user}" = {
|
||||
description = "Pleroma user";
|
||||
home = cfg.stateDir;
|
||||
extraGroups = [ cfg.group ];
|
||||
group = cfg.group;
|
||||
isSystemUser = true;
|
||||
};
|
||||
groups."${cfg.group}" = {};
|
||||
|
|
|
|||
|
|
@ -140,9 +140,12 @@ in {
|
|||
|
||||
environment.systemPackages = [ pkg ];
|
||||
|
||||
users.users.radicale.uid = config.ids.uids.radicale;
|
||||
users.users.radicale = {
|
||||
isSystemUser = true;
|
||||
group = "radicale";
|
||||
};
|
||||
|
||||
users.groups.radicale.gid = config.ids.gids.radicale;
|
||||
users.groups.radicale = {};
|
||||
|
||||
systemd.services.radicale = {
|
||||
description = "A Simple Calendar and Contact Server";
|
||||
|
|
|
|||
|
|
@ -55,9 +55,12 @@ in
|
|||
config = mkIf cfg.enable {
|
||||
|
||||
users.users.radvd =
|
||||
{ uid = config.ids.uids.radvd;
|
||||
{
|
||||
isSystemUser = true;
|
||||
group = "radvd";
|
||||
description = "Router Advertisement Daemon User";
|
||||
};
|
||||
users.groups.radvd = {};
|
||||
|
||||
systemd.services.radvd =
|
||||
{ description = "IPv6 Router Advertisement Daemon";
|
||||
|
|
|
|||
|
|
@ -259,7 +259,7 @@ in
|
|||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "smokeping";
|
||||
description = "User that runs smokeping and (optionally) thttpd";
|
||||
description = "User that runs smokeping and (optionally) thttpd. A group of the same name will be created as well.";
|
||||
};
|
||||
webService = mkOption {
|
||||
type = types.bool;
|
||||
|
|
@ -285,11 +285,12 @@ in
|
|||
users.users.${cfg.user} = {
|
||||
isNormalUser = false;
|
||||
isSystemUser = true;
|
||||
uid = config.ids.uids.smokeping;
|
||||
group = cfg.user;
|
||||
description = "smokeping daemon user";
|
||||
home = smokepingHome;
|
||||
createHome = true;
|
||||
};
|
||||
users.groups.${cfg.user} = {};
|
||||
systemd.services.smokeping = {
|
||||
wantedBy = [ "multi-user.target"];
|
||||
serviceConfig = {
|
||||
|
|
|
|||
|
|
@ -401,9 +401,12 @@ in
|
|||
config = mkIf cfg.enable {
|
||||
|
||||
users.users.sshd =
|
||||
{ isSystemUser = true;
|
||||
{
|
||||
isSystemUser = true;
|
||||
group = "sshd";
|
||||
description = "SSH privilege separation user";
|
||||
};
|
||||
users.groups.sshd = {};
|
||||
|
||||
services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";
|
||||
services.openssh.sftpServerExecutable = mkDefault "${cfgc.package}/libexec/sftp-server";
|
||||
|
|
|
|||
|
|
@ -32,7 +32,11 @@ with lib;
|
|||
config = mkIf config.services.tinydns.enable {
|
||||
environment.systemPackages = [ pkgs.djbdns ];
|
||||
|
||||
users.users.tinydns.isSystemUser = true;
|
||||
users.users.tinydns = {
|
||||
isSystemUser = true;
|
||||
group = "tinydns";
|
||||
};
|
||||
users.groups.tinydns = {};
|
||||
|
||||
systemd.services.tinydns = {
|
||||
description = "djbdns tinydns server";
|
||||
|
|
|
|||
|
|
@ -58,7 +58,9 @@ in
|
|||
security.pam.services.atd = {};
|
||||
|
||||
users.users.atd =
|
||||
{ uid = config.ids.uids.atd;
|
||||
{
|
||||
uid = config.ids.uids.atd;
|
||||
group = "atd";
|
||||
description = "atd user";
|
||||
home = "/var/empty";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -199,10 +199,12 @@ in {
|
|||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
users.users.kibana = {
|
||||
uid = config.ids.uids.kibana;
|
||||
isSystemUser = true;
|
||||
description = "Kibana service user";
|
||||
home = cfg.dataDir;
|
||||
createHome = true;
|
||||
group = "kibana";
|
||||
};
|
||||
users.groups.kibana = {};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -82,8 +82,10 @@ in {
|
|||
|
||||
users.users.hockeypuck = {
|
||||
isSystemUser = true;
|
||||
group = "hockeypuck";
|
||||
description = "Hockeypuck user";
|
||||
};
|
||||
users.groups.hockeypuck = {};
|
||||
|
||||
systemd.services.hockeypuck = {
|
||||
description = "Hockeypuck OpenPGP Key Server";
|
||||
|
|
|
|||
|
|
@ -172,8 +172,10 @@ in {
|
|||
|
||||
users.users.magnetico = {
|
||||
description = "Magnetico daemons user";
|
||||
group = "magnetico";
|
||||
isSystemUser = true;
|
||||
};
|
||||
users.groups.magnetico = {};
|
||||
|
||||
systemd.services.magneticod = {
|
||||
description = "Magnetico DHT crawler";
|
||||
|
|
|
|||
|
|
@ -60,6 +60,10 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
users.users.peerflix.uid = config.ids.uids.peerflix;
|
||||
users.users.peerflix = {
|
||||
isSystemUser = true;
|
||||
group = "peerflix";
|
||||
};
|
||||
users.groups.peerflix = {};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -114,6 +114,7 @@ in
|
|||
users.users = optionalAttrs (cfg.user == defaultUser) {
|
||||
${defaultUser} = {
|
||||
isSystemUser = true;
|
||||
group = defaultUser;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1056,10 +1056,19 @@ in
|
|||
|
||||
services.dbus.enable = true;
|
||||
|
||||
users.users.systemd-coredump.uid = config.ids.uids.systemd-coredump;
|
||||
users.users.systemd-network.uid = config.ids.uids.systemd-network;
|
||||
users.users.systemd-coredump = {
|
||||
uid = config.ids.uids.systemd-coredump;
|
||||
group = "systemd-coredump";
|
||||
};
|
||||
users.users.systemd-network = {
|
||||
uid = config.ids.uids.systemd-network;
|
||||
group = "systemd-network";
|
||||
};
|
||||
users.groups.systemd-network.gid = config.ids.gids.systemd-network;
|
||||
users.users.systemd-resolve.uid = config.ids.uids.systemd-resolve;
|
||||
users.users.systemd-resolve = {
|
||||
uid = config.ids.uids.systemd-resolve;
|
||||
group = "systemd-resolve";
|
||||
};
|
||||
users.groups.systemd-resolve.gid = config.ids.gids.systemd-resolve;
|
||||
|
||||
# Target for ‘charon send-keys’ to hook into.
|
||||
|
|
|
|||
|
|
@ -158,7 +158,7 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
users.groups.lxd.gid = config.ids.gids.lxd;
|
||||
users.groups.lxd = {};
|
||||
|
||||
users.users.root = {
|
||||
subUidRanges = [ { startUid = 1000000; count = 65536; } ];
|
||||
|
|
|
|||
|
|
@ -145,13 +145,22 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
|||
# user that is permitted to access the unix socket
|
||||
someuser = {
|
||||
isSystemUser = true;
|
||||
group = "someuser";
|
||||
extraGroups = [
|
||||
config.users.users.unbound.group
|
||||
];
|
||||
};
|
||||
|
||||
# user that is not permitted to access the unix socket
|
||||
unauthorizeduser = { isSystemUser = true; };
|
||||
unauthorizeduser = {
|
||||
isSystemUser = true;
|
||||
group = "unauthorizeduser";
|
||||
};
|
||||
|
||||
};
|
||||
users.groups = {
|
||||
someuser = {};
|
||||
unauthorizeduser = {};
|
||||
};
|
||||
|
||||
# Used for testing configuration reloading
|
||||
|
|
|
|||
Loading…
Reference in a new issue