parent
7ca00868ec
commit
42a99b1be2
@ -0,0 +1,125 @@ |
||||
{ config, lib, pkgs, ... }: |
||||
|
||||
with lib; |
||||
|
||||
let |
||||
cfg = config.services.unit; |
||||
|
||||
configFile = pkgs.writeText "unit.json" cfg.config; |
||||
|
||||
in { |
||||
options = { |
||||
services.unit = { |
||||
enable = mkEnableOption "Unit App Server"; |
||||
package = mkOption { |
||||
type = types.package; |
||||
default = pkgs.unit; |
||||
defaultText = "pkgs.unit"; |
||||
description = "Unit package to use."; |
||||
}; |
||||
user = mkOption { |
||||
type = types.str; |
||||
default = "unit"; |
||||
description = "User account under which unit runs."; |
||||
}; |
||||
group = mkOption { |
||||
type = types.str; |
||||
default = "unit"; |
||||
description = "Group account under which unit runs."; |
||||
}; |
||||
stateDir = mkOption { |
||||
default = "/var/spool/unit"; |
||||
description = "Unit data directory."; |
||||
}; |
||||
logDir = mkOption { |
||||
default = "/var/log/unit"; |
||||
description = "Unit log directory."; |
||||
}; |
||||
config = mkOption { |
||||
type = types.str; |
||||
default = '' |
||||
{ |
||||
"listeners": {}, |
||||
"applications": {} |
||||
} |
||||
''; |
||||
example = literalExample '' |
||||
{ |
||||
"listeners": { |
||||
"*:8300": { |
||||
"application": "example-php-72" |
||||
} |
||||
}, |
||||
"applications": { |
||||
"example-php-72": { |
||||
"type": "php 7.2", |
||||
"processes": 4, |
||||
"user": "nginx", |
||||
"group": "nginx", |
||||
"root": "/var/www", |
||||
"index": "index.php", |
||||
"options": { |
||||
"file": "/etc/php.d/default.ini", |
||||
"admin": { |
||||
"max_execution_time": "30", |
||||
"max_input_time": "30", |
||||
"display_errors": "off", |
||||
"display_startup_errors": "off", |
||||
"open_basedir": "/dev/urandom:/proc/cpuinfo:/proc/meminfo:/etc/ssl/certs:/var/www", |
||||
"disable_functions": "exec,passthru,shell_exec,system" |
||||
} |
||||
} |
||||
} |
||||
} |
||||
} |
||||
''; |
||||
description = "Unit configuration in JSON format. More details here https://unit.nginx.org/configuration"; |
||||
}; |
||||
}; |
||||
}; |
||||
|
||||
config = mkIf cfg.enable { |
||||
|
||||
environment.systemPackages = [ cfg.package ]; |
||||
|
||||
systemd.tmpfiles.rules = [ |
||||
"d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group} - -" |
||||
"d '${cfg.logDir}' 0750 ${cfg.user} ${cfg.group} - -" |
||||
]; |
||||
|
||||
systemd.services.unit = { |
||||
description = "Unit App Server"; |
||||
after = [ "network.target" ]; |
||||
wantedBy = [ "multi-user.target" ]; |
||||
path = with pkgs; [ curl ]; |
||||
preStart = '' |
||||
test -f '/run/unit/control.unit.sock' || rm -f '/run/unit/control.unit.sock' |
||||
''; |
||||
postStart = '' |
||||
curl -X PUT --data-binary '@${configFile}' --unix-socket '/run/unit/control.unit.sock' 'http://localhost/config' |
||||
''; |
||||
serviceConfig = { |
||||
User = cfg.user; |
||||
Group = cfg.group; |
||||
AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID"; |
||||
CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID"; |
||||
ExecStart = '' |
||||
${cfg.package}/bin/unitd --control 'unix:/run/unit/control.unit.sock' --pid '/run/unit/unit.pid' \ |
||||
--log '${cfg.logDir}/unit.log' --state '${cfg.stateDir}' --no-daemon \ |
||||
--user ${cfg.user} --group ${cfg.group} |
||||
''; |
||||
RuntimeDirectory = "unit"; |
||||
RuntimeDirectoryMode = "0750"; |
||||
}; |
||||
}; |
||||
|
||||
users.users = optionalAttrs (cfg.user == "unit") (singleton { |
||||
name = "unit"; |
||||
group = cfg.group; |
||||
}); |
||||
|
||||
users.groups = optionalAttrs (cfg.group == "unit") (singleton { |
||||
name = "unit"; |
||||
}); |
||||
}; |
||||
} |
@ -0,0 +1,24 @@ |
||||
diff --git a/src/nxt_process.c b/src/nxt_process.c
|
||||
index 5952029..7b29369 100644
|
||||
--- a/src/nxt_process.c
|
||||
+++ b/src/nxt_process.c
|
||||
@@ -136,7 +136,7 @@ nxt_process_start(nxt_task_t *task, nxt_process_t *process)
|
||||
|
||||
nxt_random_init(&thread->random);
|
||||
|
||||
- if (init->user_cred != NULL && getuid() == 0) {
|
||||
+ if (init->user_cred != NULL) {
|
||||
/* Super-user. */
|
||||
|
||||
ret = nxt_user_cred_set(task, init->user_cred);
|
||||
@@ -434,9 +434,7 @@ nxt_user_cred_get(nxt_task_t *task, nxt_user_cred_t *uc, const char *group)
|
||||
uc->base_gid = grp->gr_gid;
|
||||
}
|
||||
|
||||
- if (getuid() == 0) {
|
||||
return nxt_user_groups_get(task, uc);
|
||||
- }
|
||||
|
||||
return NXT_OK;
|
||||
}
|
||||
|
Loading…
Reference in new issue