stockholm/krebs/3modules/acl.nix

56 lines
1.7 KiB
Nix
Raw Normal View History

2022-01-28 22:34:21 +00:00
{ config, lib, pkgs, ... }: let
parents = dir:
if dir == "/" then
[ dir ]
else
[ dir ] ++ parents (builtins.dirOf dir)
;
in {
2022-01-30 09:47:23 +00:00
options.krebs.acl = lib.mkOption {
2022-01-28 22:34:21 +00:00
type = lib.types.attrsOf (lib.types.attrsOf (lib.types.submodule ({ config, ... }: {
options = {
rule = lib.mkOption {
type = lib.types.str;
default = config._module.args.name;
};
default = lib.mkOption {
type = lib.types.bool;
default = !config.parents;
};
recursive = lib.mkOption {
type = lib.types.bool;
default = !config.parents;
};
parents = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
apply ACL to every parent folder
'';
};
};
})));
default = {};
};
2022-01-30 09:47:23 +00:00
config = {
2022-01-29 18:14:21 +00:00
systemd.services = lib.mapAttrs' (path: rules: lib.nameValuePair "acl-${lib.replaceChars ["/"] ["_"] path}" {
2022-01-28 22:34:21 +00:00
wantedBy = [ "multi-user.target" ];
path = [
pkgs.acl
pkgs.coreutils
];
serviceConfig = {
2022-01-29 18:14:21 +00:00
ExecStart = pkgs.writers.writeDash "acl" (lib.concatStrings (
lib.mapAttrsToList (_: rule: ''
setfacl -${lib.optionalString rule.recursive "R"}m ${rule.rule} ${path}
${lib.optionalString rule.default "setfacl -${lib.optionalString rule.recursive "R"}dm ${rule.rule} ${path}"}
${lib.optionalString rule.parents (lib.concatMapStringsSep "\n" (folder: "setfacl -m ${rule.rule} ${folder}") (parents path))}
'') rules
));
2022-01-28 22:34:21 +00:00
RemainAfterExit = true;
2022-01-29 18:14:21 +00:00
Type = "simple";
2022-01-28 22:34:21 +00:00
};
2022-01-30 09:47:23 +00:00
}) config.krebs.acl;
2022-01-28 22:34:21 +00:00
};
}