From c9c8a2c5b3b72668656add5409853db8e15ea99d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Wed, 3 Jan 2018 12:10:45 +0100 Subject: [PATCH] nixos/memcached: make unix sockets usuable before: - /var/run/memcached is a bad default for a socket path, since its parent directory must be writeable by memcached. - Socket directory was not created by the module itself -> this was left as a burden to the user? - Having a static uid with a dynamic user name is not very useful. after: - Replace services.memcached.socket by a boolean flag. This simplifies our code, since we do not have to check if the user specifies a path with a parent directory that should be owned by memcached (/run/memcached/memcached.sock -> /run/memcached). - Remove fixed uid/gid allocation. The only file ever owned by the daemon is the socket that will be recreated on every start. Therefore user and group ids do not need to be static. - only create the memcached user, if the user has not specified a different one. The major use case for changing option is to allow existing services (such as php-fpm) opening the local unix socket. If we would unconditionally create a user that option would be useless. --- nixos/doc/manual/release-notes/rl-1803.xml | 8 +++ nixos/modules/misc/ids.nix | 4 +- .../modules/services/databases/memcached.nix | 51 ++++++++++--------- 3 files changed, 38 insertions(+), 25 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-1803.xml b/nixos/doc/manual/release-notes/rl-1803.xml index 3dc4c353e25..0ab119232ee 100644 --- a/nixos/doc/manual/release-notes/rl-1803.xml +++ b/nixos/doc/manual/release-notes/rl-1803.xml @@ -131,6 +131,14 @@ following incompatible changes: Other types dependencies should be unaffected. + + + The memcached service no longer accept dynamic socket + paths via . Unix sockets can be + still enabled by and + will be accessible at /run/memcached/memcached.sock. + + diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index 579a3f6393c..d0cd32cb904 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -197,7 +197,7 @@ #input = 174; # unused sddm = 175; tss = 176; - memcached = 177; + #memcached = 177; removed 2018-01-03 ntp = 179; zabbix = 180; redis = 181; @@ -475,7 +475,7 @@ input = 174; sddm = 175; tss = 176; - #memcached = 177; # unused + #memcached = 177; # unused, removed 2018-01-03 #ntp = 179; # unused #zabbix = 180; # unused #redis = 181; # unused diff --git a/nixos/modules/services/databases/memcached.nix b/nixos/modules/services/databases/memcached.nix index c6875af506d..46bc6fc5c13 100644 --- a/nixos/modules/services/databases/memcached.nix +++ b/nixos/modules/services/databases/memcached.nix @@ -40,11 +40,7 @@ in description = "The port to bind to"; }; - socket = mkOption { - default = ""; - description = "Unix socket path to listen on. Setting this will disable network support"; - example = "/var/run/memcached"; - }; + enableUnixSocket = mkEnableOption "unix socket at /run/memcached/memcached.sock"; maxMemory = mkOption { default = 64; @@ -68,31 +64,40 @@ in config = mkIf config.services.memcached.enable { - users.extraUsers.memcached = - { name = cfg.user; - uid = config.ids.uids.memcached; - description = "Memcached server user"; - }; + users.extraUsers = optional (cfg.user == "memcached") { + name = "memcached"; + description = "Memcached server user"; + }; environment.systemPackages = [ memcached ]; - systemd.services.memcached = - { description = "Memcached server"; + systemd.services.memcached = { + description = "Memcached server"; - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; - serviceConfig = { - ExecStart = - let - networking = if cfg.socket != "" - then "-s ${cfg.socket}" - else "-l ${cfg.listen} -p ${toString cfg.port}"; - in "${memcached}/bin/memcached ${networking} -m ${toString cfg.maxMemory} -c ${toString cfg.maxConnections} ${concatStringsSep " " cfg.extraOptions}"; + serviceConfig = { + PermissionsStartOnly = true; + ExecStartPre = optionals cfg.enableUnixSocket [ + "${pkgs.coreutils}/bin/install -d -o ${cfg.user} /run/memcached/" + "${pkgs.coreutils}/bin/chown -R ${cfg.user} /run/memcached/" + ]; + ExecStart = + let + networking = if cfg.enableUnixSocket + then "-s /run/memcached/memcached.sock" + else "-l ${cfg.listen} -p ${toString cfg.port}"; + in "${memcached}/bin/memcached ${networking} -m ${toString cfg.maxMemory} -c ${toString cfg.maxConnections} ${concatStringsSep " " cfg.extraOptions}"; - User = cfg.user; - }; + User = cfg.user; }; + }; }; + imports = [ + (mkRemovedOptionModule ["services" "memcached" "socket"] '' + This option was replaced by a fixed unix socket path at /run/memcached/memcached.sock enabled using services.memached.enableUnixSocket. + '') + ]; }