nixpkgs/nixos/modules
Andreas Rammhold 5e602f88d1
nixos/modules/services/networking/unbound: update systemd unit
Previously we just applied a very minimal set of restrictions and
trusted unbound to properly drop root privs and capabilities.

With this change I am (for the most part) just using the upstream
example unit file for unbound. The main difference is that we start
unbound was `unbound` user with the required capabilities instead of
letting unbound do the chroot & uid/gid changes.

The upstream unit configuration this is based on is a lot stricter with
all kinds of permissions then our previous variant. It also came with
the default of having the `Type` set to `notify`, therefore we are also
using the `unbound-with-systemd` package here. Unbound will start up,
read the configuration files and start listening on the configured ports
before systemd will declare the unit "running". This will likely help
with startup order and the occasional race condition during system
activation where the DNS service is started but not yet ready to answer
queries.

Aditionally to the much stricter runtime environmet I removed the
`/dev/urandom` mount lines we previously had in the code (that would
randomly fail during `stop`-phase).

The `preStart` script is now only required if we enabled the trust
anchor updates (which are still enabled by default).

Another beneefit of the refactoring is that we can now issue reloads via
either `pkill -HUP unbound` or `systemctl reload unbound` to reload the
running configuration without taking the daemon offline. A prerequisite
of this was that unbound configuration is available on a well known path
on the file system. I went for /etc/unbound/unbound.conf as that is the
default in the CLI tooling which in turn enables us to use
`unbound-control` without passing a custom configuration location.
2020-11-03 19:21:24 +01:00
..
config fontdir: add ttc to font regex 2020-10-26 10:45:22 +08:00
hardware Merge pull request #96511 from Zopieux/rtl_433_prom 2020-10-23 23:24:38 +02:00
i18n/input-method hime: fix enable hime, remove hime-all package 2020-10-17 10:48:31 +08:00
installer nixos-install: pass through keep-going flag 2020-10-31 17:13:45 +01:00
misc nixos/murmur: add murmur group, don't run as nogroup 2020-10-29 10:32:04 +01:00
profiles nixos/hardened: update blacklisted filesystems 2020-09-27 06:16:58 +00:00
programs Merge pull request #83687 from primeos/wshowkeys 2020-10-26 18:55:16 -07:00
security Merge pull request #101370 from m1cr0man/ssl-test-certs 2020-10-28 17:21:57 +01:00
services nixos/modules/services/networking/unbound: update systemd unit 2020-11-03 19:21:24 +01:00
system nixos/modules: deprecation warning for StartLimitInterval in [Service] 2020-10-31 16:50:35 +01:00
tasks doc: Document a workaround for using an FQDN as hostname 2020-10-10 10:48:54 -07:00
testing nixos/tests: only apply qemu parameters if the options are defined 2020-10-25 13:42:01 +01:00
virtualisation amazon-image: random.trust_cpu=on to cut 10s from boot 2020-10-30 13:45:19 -04:00
module-list.nix Merge pull request #83687 from primeos/wshowkeys 2020-10-26 18:55:16 -07:00
rename.nix Merge pull request #91256 from prusnak/seeks 2020-09-18 16:32:33 +02:00