public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #86940 from flokli/move-nss-systemd

Browse Source 
nixos/systemd: move systemd-provided NSS modules to systemd module
This commit is contained in:
Florian Klink 2020-05-05 23:17:21 +02:00 committed by GitHub
commit 265415fb80
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 25 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
nixos/modules/config/nsswitch.nix
View File

@ -8,30 +8,22 @@ let
# only with nscd up and running we can load NSS modules that are not integrated in NSS # only with nscd up and running we can load NSS modules that are not integrated in NSS
canLoadExternalModules = config.services.nscd.enable; canLoadExternalModules = config.services.nscd.enable;
myhostname = canLoadExternalModules;
mymachines = canLoadExternalModules;
# XXX Move these to their respective modules # XXX Move these to their respective modules
nssmdns = canLoadExternalModules && config.services.avahi.nssmdns; nssmdns = canLoadExternalModules && config.services.avahi.nssmdns;
nsswins = canLoadExternalModules && config.services.samba.nsswins; nsswins = canLoadExternalModules && config.services.samba.nsswins;
ldap = canLoadExternalModules && (config.users.ldap.enable && config.users.ldap.nsswitch); ldap = canLoadExternalModules && (config.users.ldap.enable && config.users.ldap.nsswitch);
resolved = canLoadExternalModules && config.services.resolved.enable;
hostArray = mkMerge [ hostArray = mkMerge [
(mkBefore [ "files" ]) (mkBefore [ "files" ])
(mkIf mymachines [ "mymachines" ])
(mkIf nssmdns [ "mdns_minimal [NOTFOUND=return]" ]) (mkIf nssmdns [ "mdns_minimal [NOTFOUND=return]" ])
(mkIf nsswins [ "wins" ]) (mkIf nsswins [ "wins" ])
(mkIf resolved [ "resolve [!UNAVAIL=return]" ])
(mkAfter [ "dns" ]) (mkAfter [ "dns" ])
(mkIf nssmdns (mkOrder 1501 [ "mdns" ])) # 1501 to ensure it's after dns (mkIf nssmdns (mkOrder 1501 [ "mdns" ])) # 1501 to ensure it's after dns
(mkIf myhostname (mkOrder 1600 [ "myhostname" ])) # 1600 to ensure it's always the last
]; ];
passwdArray = mkMerge [ passwdArray = mkMerge [
(mkBefore [ "files" ]) (mkBefore [ "files" ])
(mkIf ldap [ "ldap" ]) (mkIf ldap [ "ldap" ])
(mkIf mymachines [ "mymachines" ])
(mkIf canLoadExternalModules (mkAfter [ "systemd" ]))
]; ];
shadowArray = mkMerge [ shadowArray = mkMerge [
@ -134,11 +126,6 @@ in {
assertion = config.system.nssModules.path != "" -> canLoadExternalModules; assertion = config.system.nssModules.path != "" -> canLoadExternalModules;
message = "Loading NSS modules from path ${config.system.nssModules.path} requires nscd being enabled."; message = "Loading NSS modules from path ${config.system.nssModules.path} requires nscd being enabled.";
} }
{
# resolved does not need to add to nssModules, therefore needs an extra assertion
assertion = resolved -> canLoadExternalModules;
message = "Loading systemd-resolved's nss-resolve NSS module requires nscd being enabled.";
}
]; ];
# Name Service Switch configuration file. Required by the C # Name Service Switch configuration file. Required by the C
@ -164,12 +151,5 @@ in {
hosts = hostArray; hosts = hostArray;
services = mkBefore [ "files" ]; services = mkBefore [ "files" ];
}; };
# Systemd provides nss-myhostname to ensure that our hostname
# always resolves to a valid IP address. It returns all locally
# configured IP addresses, or ::1 and 127.0.0.2 as
# fallbacks. Systemd also provides nss-mymachines to return IP
# addresses of local containers.
system.nssModules = (optionals canLoadExternalModules [ config.systemd.package.out ]);
}; };
} }

4
nixos/modules/system/boot/resolved.nix
View File

@ -138,6 +138,10 @@ in
users.users.resolved.group = "systemd-resolve"; users.users.resolved.group = "systemd-resolve";
# add resolve to nss hosts database if enabled and nscd enabled
# system.nssModules is configured in nixos/modules/system/boot/systemd.nix
system.nssDatabases.hosts = optional config.services.nscd.enable "resolve [!UNAVAIL=return]";
systemd.additionalUpstreamSystemUnits = [ systemd.additionalUpstreamSystemUnits = [
"systemd-resolved.service" "systemd-resolved.service"
]; ];

21
nixos/modules/system/boot/systemd.nix
View File

@ -827,6 +827,27 @@ in
system.build.units = cfg.units; system.build.units = cfg.units;
# Systemd provides various NSS modules to look up dynamic users, locally
# configured IP adresses and local container hostnames.
# On NixOS, these can only be passed to the NSS system via nscd (and its
# LD_LIBRARY_PATH), which is why it's usually a very good idea to have nscd
# enabled (also see the config.nscd.enable description).
# While there is already an assertion in place complaining loudly about
# having nssModules configured and nscd disabled, for some reason we still
# check for nscd being enabled before adding to nssModules.
system.nssModules = optional config.services.nscd.enable systemd.out;
system.nssDatabases = mkIf config.services.nscd.enable {
hosts = (mkMerge [
[ "mymachines" ]
(mkOrder 1600 [ "myhostname" ] # 1600 to ensure it's always the last
)
]);
passwd = (mkMerge [
[ "mymachines" ]
(mkAfter [ "systemd" ])
]);
};
environment.systemPackages = [ systemd ]; environment.systemPackages = [ systemd ];
environment.etc = let environment.etc = let