|
143 | 143 | // optionalAttrs config.services.postgresql.enable { |
144 | 144 | log.dbEnabled = true; |
145 | 145 | postgres = { |
146 | | - user = cfg.user; |
| 146 | + inherit (cfg) user; |
147 | 147 | host = "/run/postgresql"; |
148 | 148 | port = 5432; |
149 | 149 | mainDb = cfg.user; |
@@ -225,42 +225,41 @@ in { |
225 | 225 |
|
226 | 226 | # Ensure main service (radarr.service, etc.) starts after |
227 | 227 | # directories are created and configured dependencies |
228 | | - ${serviceName} = |
229 | | - { |
230 | | - after = |
231 | | - ["nixflix-setup-dirs.service"] |
232 | | - ++ (optional (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) "${serviceName}-env.service") |
233 | | - ++ (optional config.services.postgresql.enable "postgresql-ready.target") |
234 | | - ++ (optional config.nixflix.mullvad.enable "mullvad-config.service"); |
235 | | - requires = |
236 | | - ["nixflix-setup-dirs.service"] |
237 | | - ++ (optional (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) "${serviceName}-env.service") |
238 | | - ++ (optional config.services.postgresql.enable "postgresql-ready.target"); |
239 | | - wants = optional config.nixflix.mullvad.enable "mullvad-config.service"; |
| 228 | + ${serviceName} = { |
| 229 | + after = |
| 230 | + ["nixflix-setup-dirs.service"] |
| 231 | + ++ (optional (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) "${serviceName}-env.service") |
| 232 | + ++ (optional config.services.postgresql.enable "postgresql-ready.target") |
| 233 | + ++ (optional config.nixflix.mullvad.enable "mullvad-config.service"); |
| 234 | + requires = |
| 235 | + ["nixflix-setup-dirs.service"] |
| 236 | + ++ (optional (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) "${serviceName}-env.service") |
| 237 | + ++ (optional config.services.postgresql.enable "postgresql-ready.target"); |
| 238 | + wants = optional config.nixflix.mullvad.enable "mullvad-config.service"; |
240 | 239 |
|
241 | | - # Always use static users and configure VPN bypass |
242 | | - serviceConfig = |
243 | | - { |
244 | | - # DynamicUser causes issues with VPN bypass and permissions |
245 | | - DynamicUser = mkForce false; |
246 | | - User = cfg.user; |
247 | | - Group = cfg.group; |
248 | | - } |
249 | | - // optionalAttrs (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) { |
250 | | - EnvironmentFile = "/run/${serviceName}/env"; |
251 | | - } |
252 | | - // optionalAttrs (config.nixflix.mullvad.enable && !cfg.vpn.enable) { |
253 | | - # Bypass VPN by wrapping with mullvad-exclude |
254 | | - ExecStart = mkForce (pkgs.writeShellScript "${serviceName}-vpn-bypass" '' |
255 | | - exec /run/wrappers/bin/mullvad-exclude ${getExe config.services.${serviceName}.package} \ |
256 | | - -nobrowser -data='${stateDir}' |
257 | | - ''); |
258 | | - # mullvad-exclude needs CAP_SYS_ADMIN to manipulate cgroups |
259 | | - AmbientCapabilities = "CAP_SYS_ADMIN"; |
260 | | - # Delegate allows the service to manage its cgroup subtree |
261 | | - Delegate = mkForce true; |
262 | | - }; |
263 | | - }; |
| 240 | + # Always use static users and configure VPN bypass |
| 241 | + serviceConfig = |
| 242 | + { |
| 243 | + # DynamicUser causes issues with VPN bypass and permissions |
| 244 | + DynamicUser = mkForce false; |
| 245 | + User = cfg.user; |
| 246 | + Group = cfg.group; |
| 247 | + } |
| 248 | + // optionalAttrs (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) { |
| 249 | + EnvironmentFile = "/run/${serviceName}/env"; |
| 250 | + } |
| 251 | + // optionalAttrs (config.nixflix.mullvad.enable && !cfg.vpn.enable) { |
| 252 | + # Bypass VPN by wrapping with mullvad-exclude |
| 253 | + ExecStart = mkForce (pkgs.writeShellScript "${serviceName}-vpn-bypass" '' |
| 254 | + exec /run/wrappers/bin/mullvad-exclude ${getExe config.services.${serviceName}.package} \ |
| 255 | + -nobrowser -data='${stateDir}' |
| 256 | + ''); |
| 257 | + # mullvad-exclude needs CAP_SYS_ADMIN to manipulate cgroups |
| 258 | + AmbientCapabilities = "CAP_SYS_ADMIN"; |
| 259 | + # Delegate allows the service to manage its cgroup subtree |
| 260 | + Delegate = mkForce true; |
| 261 | + }; |
| 262 | + }; |
264 | 263 | } |
265 | 264 | # Only create config and rootfolders services if apiKeyPath is configured |
266 | 265 | // optionalAttrs (cfg.config.apiKeyPath != null && cfg.config.hostConfig.passwordPath != null) { |
|
0 commit comments