nixpkgs/nixos/modules/services/networking/nextdns.nix
lf- b37bbca521 nixos/modules: fix systemd start rate-limits
These were broken since 2016:
f0367da7d1
since StartLimitIntervalSec got moved into [Unit] from [Service].
StartLimitBurst has also been moved accordingly, so let's fix that one
too.

NixOS systems have been producing logs such as:
/nix/store/wf98r55aszi1bkmln1lvdbp7znsfr70i-unit-caddy.service/caddy.service:31:
Unknown key name 'StartLimitIntervalSec' in section 'Service', ignoring.

I have also removed some unnecessary duplication in units disabling
rate limiting since setting either interval or burst to zero disables it
(ad16158c10/src/basic/ratelimit.c (L16))
2020-10-31 01:35:56 -07:00

45 lines
1.2 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.nextdns;
in {
options = {
services.nextdns = {
enable = mkOption {
type = types.bool;
default = false;
description = "Whether to enable the NextDNS DNS/53 to DoH Proxy service.";
};
arguments = mkOption {
type = types.listOf types.str;
default = [];
example = [ "-config" "10.0.3.0/24=abcdef" ];
description = "Additional arguments to be passed to nextdns run.";
};
};
};
# https://github.com/nextdns/nextdns/blob/628ea509eaaccd27adb66337db03e5b56f6f38a8/host/service/systemd/service.go
config = mkIf cfg.enable {
systemd.services.nextdns = {
description = "NextDNS DNS/53 to DoH Proxy";
environment = {
SERVICE_RUN_MODE = "1";
};
startLimitIntervalSec = 5;
startLimitBurst = 10;
serviceConfig = {
ExecStart = "${pkgs.nextdns}/bin/nextdns run ${escapeShellArgs config.services.nextdns.arguments}";
RestartSec = 120;
LimitMEMLOCK = "infinity";
};
after = [ "network.target" ];
before = [ "nss-lookup.target" ];
wants = [ "nss-lookup.target" ];
wantedBy = [ "multi-user.target" ];
};
};
}