29c5178bdf
list of user accounts that the job needs to run. For instance, the
SSH daemon job says:
{ name = "sshd";
uid = (import ../system/ids.nix).uids.sshd;
description = "SSH privilege separation user";
home = "/var/empty";
}
The activation script creates the system users/groups and updates
them as well. So a change in the Nix expression can be realised in
/etc/{group,passwd} by running nixos-rebuild.
svn path=/nixos/trunk/; revision=8846
53 lines
877 B
Nix
53 lines
877 B
Nix
{ntp, modprobe, glibc, pwdutils, writeText, servers}:
|
|
|
|
let
|
|
|
|
stateDir = "/var/lib/ntp";
|
|
|
|
ntpUser = "ntp";
|
|
|
|
config = writeText "ntp.conf" "
|
|
driftfile ${stateDir}/ntp.drift
|
|
|
|
${toString (map (server: "server " + server + "\n") servers)}
|
|
";
|
|
|
|
ntpFlags = "-c ${config} -u ${ntpUser}:nogroup -i ${stateDir}";
|
|
|
|
in
|
|
|
|
{
|
|
name = "ntpd";
|
|
|
|
users = [
|
|
{ name = ntpUser;
|
|
uid = (import ../system/ids.nix).uids.ntp;
|
|
description = "NTP daemon user";
|
|
home = stateDir;
|
|
}
|
|
];
|
|
|
|
job = "
|
|
description \"NTP daemon\"
|
|
|
|
start on ip-up
|
|
stop on ip-down
|
|
stop on shutdown
|
|
|
|
start script
|
|
|
|
mkdir -m 0755 -p ${stateDir}
|
|
chown ${ntpUser} ${stateDir}
|
|
|
|
# Needed to run ntpd as an unprivileged user.
|
|
${modprobe}/sbin/modprobe capability || true
|
|
|
|
${ntp}/bin/ntpd -q -g ${ntpFlags}
|
|
|
|
end script
|
|
|
|
respawn ${ntp}/bin/ntpd -n ${ntpFlags}
|
|
";
|
|
|
|
}
|