diff --git a/nixos/doc/manual/release-notes/rl-2103.xml b/nixos/doc/manual/release-notes/rl-2103.xml
index 458170e803b..2b0144a69c2 100644
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@@ -278,6 +278,15 @@
= true;
+
+
+ The options services.slurm.dbdserver.storagePass
+ and services.slurm.dbdserver.configFile have been removed.
+ Use services.slurm.dbdserver.storagePassFile instead to provide the database password.
+ Extra config options can be given via the option services.slurm.dbdserver.extraConfig. The actual configuration file is created on the fly on startup of the service.
+ This avoids that the password gets exposed in the nix store.
+
+
diff --git a/nixos/modules/services/computing/slurm/slurm.nix b/nixos/modules/services/computing/slurm/slurm.nix
index 705390a21d4..302f058926c 100644
--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@@ -34,13 +34,12 @@ let
${cfg.extraCgroupConfig}
'';
- slurmdbdConf = pkgs.writeTextDir "slurmdbd.conf"
+ slurmdbdConf = pkgs.writeText "slurmdbd.conf"
''
DbdHost=${cfg.dbdserver.dbdHost}
SlurmUser=${cfg.user}
StorageType=accounting_storage/mysql
StorageUser=${cfg.dbdserver.storageUser}
- ${optionalString (cfg.dbdserver.storagePass != null) "StoragePass=${cfg.dbdserver.storagePass}"}
${cfg.dbdserver.extraConfig}
'';
@@ -95,26 +94,12 @@ in
'';
};
- storagePass = mkOption {
- type = types.nullOr types.str;
+ storagePassFile = mkOption {
+ type = with types; nullOr str;
default = null;
description = ''
- Database password. Note that this password will be publicable
- readable in the nix store. Use
- to store the and config file and password outside the nix store.
- '';
- };
-
- configFile = mkOption {
- type = types.nullOr types.str;
- default = null;
- description = ''
- Path to slurmdbd.conf. The password for the database connection
- is stored in the config file. Use this option to specfify a path
- outside the nix store. If this option is unset a configuration file
- will be generated. See also:
- slurmdbd.conf
- 8.
+ Path to file with database password. The content of this will be used to
+ create the password for the StoragePass option.
'';
};
@@ -122,7 +107,9 @@ in
type = types.lines;
default = "";
description = ''
- Extra configuration for slurmdbd.conf
+ Extra configuration for slurmdbd.conf See also:
+ slurmdbd.conf
+ 8.
'';
};
};
@@ -292,6 +279,16 @@ in
};
+ imports = [
+ (mkRemovedOptionModule [ "services" "slurm" "dbdserver" "storagePass" ] ''
+ This option has been removed so that the database password is not exposed via the nix store.
+ Use services.slurm.dbdserver.storagePassFile to provide the database password.
+ '')
+ (mkRemovedOptionModule [ "services" "slurm" "dbdserver" "configFile" ] ''
+ This option has been removed. Use services.slurm.dbdserver.storagePassFile
+ and services.slurm.dbdserver.extraConfig instead.
+ '')
+ ];
###### implementation
@@ -386,23 +383,34 @@ in
'';
};
- systemd.services.slurmdbd = mkIf (cfg.dbdserver.enable) {
+ systemd.services.slurmdbd = let
+ # slurm strips the last component off the path
+ configPath = "$RUNTIME_DIRECTORY/slurmdbd.conf";
+ in mkIf (cfg.dbdserver.enable) {
path = with pkgs; [ wrappedSlurm munge coreutils ];
wantedBy = [ "multi-user.target" ];
after = [ "network.target" "munged.service" "mysql.service" ];
requires = [ "munged.service" "mysql.service" ];
- # slurm strips the last component off the path
- environment.SLURM_CONF =
- if (cfg.dbdserver.configFile == null) then
- "${slurmdbdConf}/slurm.conf"
- else
- cfg.dbdserver.configFile;
+ preStart = ''
+ cp ${slurmdbdConf} ${configPath}
+ chmod 600 ${configPath}
+ chown ${cfg.user} ${configPath}
+ ${optionalString (cfg.dbdserver.storagePassFile != null) ''
+ echo "StoragePass=$(cat ${cfg.dbdserver.storagePassFile})" \
+ >> ${configPath}
+ ''}
+ '';
+
+ script = ''
+ export SLURM_CONF=${configPath}
+ exec ${cfg.package}/bin/slurmdbd -D
+ '';
serviceConfig = {
- Type = "forking";
- ExecStart = "${cfg.package}/bin/slurmdbd";
+ RuntimeDirectory = "slurmdbd";
+ Type = "simple";
PIDFile = "/run/slurmdbd.pid";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
};
diff --git a/nixos/tests/slurm.nix b/nixos/tests/slurm.nix
index a54c5d9db48..97e031a6279 100644
--- a/nixos/tests/slurm.nix
+++ b/nixos/tests/slurm.nix
@@ -86,14 +86,16 @@ in {
dbd =
{ pkgs, ... } :
- {
+ let
+ passFile = pkgs.writeText "dbdpassword" "password123";
+ in {
networking.firewall.enable = false;
systemd.tmpfiles.rules = [
"f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest"
];
services.slurm.dbdserver = {
enable = true;
- storagePass = "password123";
+ storagePassFile = "${passFile}";
};
services.mysql = {
enable = true;
diff --git a/pkgs/servers/computing/slurm/default.nix b/pkgs/servers/computing/slurm/default.nix
index bde82468b72..ac261a9a113 100644
--- a/pkgs/servers/computing/slurm/default.nix
+++ b/pkgs/servers/computing/slurm/default.nix
@@ -9,7 +9,7 @@
stdenv.mkDerivation rec {
pname = "slurm";
- version = "20.02.6.1";
+ version = "20.11.0.1";
# N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
# because the latter does not keep older releases.
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
repo = "slurm";
# The release tags use - instead of .
rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
- sha256 = "0vllyljsmv3y9hw4vfgnz9cnjqhlk55dy1bipssw872aldlxfcdk";
+ sha256 = "0f750wlvm48j5b2fkvhy47zyagxfl6kbn2m9lx0spxwyn9qgh6bn";
};
outputs = [ "out" "dev" ];