forked from mirrors/nixpkgs
9e2308ed80
It seems that dnsdist doesn't actually request CAP_NET_BIND_SERVICE, which is why normally it's executed and root and setuids to another, unprivileged, user. This means that as it is, dnsdist will be unable to bind to any port under 1024 and will fail with access denied. Removing CAP_SETGID and CAP_SETUID is also related to this as we don't actually change the uid or gid after the fact as we use DynamicUser. (That part isn't strictly NEEDED but there's no reason to have those capabilities if we don't use them). There are also some additional sandboxing we can remove from the service definition as they are assumed true or strict by DynamicUser: specifically PrivateTmp and ProtectSystem respectively. ProtectHome is still there, despite being assumed read-only as setting it to true means they are seen as empty. I don't think it really matters as I don't know if systemd will ignore it or not, but I didn't see any reason to go hunting for excuses to make it a bigger change.
61 lines
1.5 KiB
Nix
61 lines
1.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.dnsdist;
|
|
configFile = pkgs.writeText "dndist.conf" ''
|
|
setLocal('${cfg.listenAddress}:${toString cfg.listenPort}')
|
|
${cfg.extraConfig}
|
|
'';
|
|
in {
|
|
options = {
|
|
services.dnsdist = {
|
|
enable = mkEnableOption "dnsdist domain name server";
|
|
|
|
listenAddress = mkOption {
|
|
type = types.str;
|
|
description = "Listen IP Address";
|
|
default = "0.0.0.0";
|
|
};
|
|
listenPort = mkOption {
|
|
type = types.int;
|
|
description = "Listen port";
|
|
default = 53;
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
type = types.lines;
|
|
default = ''
|
|
'';
|
|
description = ''
|
|
Extra lines to be added verbatim to dnsdist.conf.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf config.services.dnsdist.enable {
|
|
systemd.services.dnsdist = {
|
|
description = "dnsdist load balancer";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = ["network.target"];
|
|
|
|
serviceConfig = {
|
|
Restart="on-failure";
|
|
RestartSec="1";
|
|
DynamicUser = true;
|
|
StartLimitInterval="0";
|
|
PrivateDevices=true;
|
|
AmbientCapabilities="CAP_NET_BIND_SERVICE";
|
|
CapabilityBoundingSet="CAP_NET_BIND_SERVICE";
|
|
ExecStart = "${pkgs.dnsdist}/bin/dnsdist --supervised --disable-syslog --config ${configFile}";
|
|
ProtectHome=true;
|
|
RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
|
|
LimitNOFILE="16384";
|
|
TasksMax="8192";
|
|
};
|
|
};
|
|
};
|
|
}
|