de251704d6
nscd doesn't create any files outside of /run/nscd unless the nscd.conf "persistent" option is used, which we don't do by default. Therefore it doesn't matter what UID/GID we run this service as, so long as it isn't shared with any other running processes. /run/nscd does need to be owned by the same UID that the service is running as, but systemd takes care of that for us thanks to the RuntimeDirectory directive. If someone wants to turn on the "persistent" option, they need to manually configure users.users.nscd and systemd.tmpfiles.rules so that /var/db/nscd is owned by the same user that nscd runs as. In an all-defaults boot.isContainer configuration of NixOS, this removes the only user which did not have a pre-assigned UID.
52 lines
2.1 KiB
Plaintext
52 lines
2.1 KiB
Plaintext
# We basically use nscd as a proxy for forwarding nss requests to appropriate
|
|
# nss modules, as we run nscd with LD_LIBRARY_PATH set to the directory
|
|
# containing all such modules
|
|
# Note that we can not use `enable-cache no` As this will actually cause nscd
|
|
# to just reject the nss requests it receives, which then causes glibc to
|
|
# fallback to trying to handle the request by itself. Which won't work as glibc
|
|
# is not aware of the path in which the nss modules live. As a workaround, we
|
|
# have `enable-cache yes` with an explicit ttl of 0
|
|
threads 1
|
|
paranoia no
|
|
debug-level 0
|
|
|
|
enable-cache passwd yes
|
|
positive-time-to-live passwd 0
|
|
negative-time-to-live passwd 0
|
|
suggested-size passwd 211
|
|
check-files passwd yes
|
|
persistent passwd no
|
|
shared passwd yes
|
|
|
|
enable-cache group yes
|
|
positive-time-to-live group 0
|
|
negative-time-to-live group 0
|
|
suggested-size group 211
|
|
check-files group yes
|
|
persistent group no
|
|
shared group yes
|
|
|
|
enable-cache netgroup yes
|
|
positive-time-to-live netgroup 0
|
|
negative-time-to-live netgroup 0
|
|
suggested-size netgroup 211
|
|
check-files netgroup yes
|
|
persistent netgroup no
|
|
shared netgroup yes
|
|
|
|
enable-cache hosts yes
|
|
positive-time-to-live hosts 600
|
|
negative-time-to-live hosts 0
|
|
suggested-size hosts 211
|
|
check-files hosts yes
|
|
persistent hosts no
|
|
shared hosts yes
|
|
|
|
enable-cache services yes
|
|
positive-time-to-live services 0
|
|
negative-time-to-live services 0
|
|
suggested-size services 211
|
|
check-files services yes
|
|
persistent services no
|
|
shared services yes
|