diff options
author | makefu <github@syntax-fehler.de> | 2019-04-17 21:48:20 +0200 |
---|---|---|
committer | makefu <github@syntax-fehler.de> | 2019-04-17 21:48:20 +0200 |
commit | 1314eb9284697b46d8208c138cf2349816e15c5f (patch) | |
tree | ad243d353ccd7f451eb1ee209bedc63c7acc7c41 /krebs/3modules/permown.nix | |
parent | 12f77bbed628e4071ac300af77857815be97a344 (diff) | |
parent | 84ad0b0a93eccdef0e4ca05fd4091f014cb1ac25 (diff) |
Merge remote-tracking branch 'tv/master'
Diffstat (limited to 'krebs/3modules/permown.nix')
-rw-r--r-- | krebs/3modules/permown.nix | 74 |
1 files changed, 74 insertions, 0 deletions
diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix new file mode 100644 index 000000000..7a86013e1 --- /dev/null +++ b/krebs/3modules/permown.nix @@ -0,0 +1,74 @@ +with import <stockholm/lib>; +{ config, pkgs, ... }: { + + options.krebs.permown = mkOption { + default = []; + type = types.listOf (types.submodule { + options = { + directory-mode = mkOption { + default = "=rwx"; + type = types.str; # TODO + }; + file-mode = mkOption { + default = "=rw"; + type = types.str; # TODO + }; + group = mkOption { + apply = x: if x == null then "" else x; + default = null; + type = types.nullOr types.groupname; + }; + owner = mkOption { + type = types.username; + }; + path = mkOption { + type = types.absolute-pathname; + }; + umask = mkOption { + default = "0027"; + type = types.file-mode; + }; + }; + }); + }; + + config.systemd.services = genAttrs' config.krebs.permown (plan: { + name = "permown.${replaceStrings ["/"] ["_"] plan.path}"; + value = { + environment = { + DIR_MODE = plan.directory-mode; + FILE_MODE = plan.file-mode; + OWNER_GROUP = "${plan.owner}:${plan.group}"; + ROOT_PATH = plan.path; + }; + path = [ + pkgs.coreutils + pkgs.findutils + pkgs.inotifyTools + ]; + serviceConfig = { + ExecStart = pkgs.writeDash "permown" '' + set -efu + + find "$ROOT_PATH" -exec chown "$OWNER_GROUP" {} + + find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} + + find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} + + + inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" | + while read -r path; do + if test -d "$path"; then + exec "$0" "$@" + fi + chown "$OWNER_GROUP" "$path" + chmod "$FILE_MODE" "$path" + done + ''; + Restart = "always"; + RestartSec = 10; + UMask = plan.umask; + }; + wantedBy = [ "multi-user.target" ]; + }; + }); + +} |