diff options
author | makefu <github@syntax-fehler.de> | 2022-02-01 13:54:09 +0100 |
---|---|---|
committer | makefu <github@syntax-fehler.de> | 2022-02-01 13:54:09 +0100 |
commit | c564c4f0f48e6d6e889f50b520b7c512df527660 (patch) | |
tree | 540a8ed795596c2de673f1fb4326dd89a003c1a4 /krebs/3modules/acl.nix | |
parent | 965a6c96c3b7216bf8ca1b985f8bece6c73213c4 (diff) | |
parent | be042e3446905e2517b530403bacc63b6de49d34 (diff) |
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'krebs/3modules/acl.nix')
-rw-r--r-- | krebs/3modules/acl.nix | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/krebs/3modules/acl.nix b/krebs/3modules/acl.nix new file mode 100644 index 00000000..9cdbb6cf --- /dev/null +++ b/krebs/3modules/acl.nix @@ -0,0 +1,55 @@ +{ config, lib, pkgs, ... }: let + parents = dir: + if dir == "/" then + [ dir ] + else + [ dir ] ++ parents (builtins.dirOf dir) + ; +in { + options.krebs.acl = lib.mkOption { + type = lib.types.attrsOf (lib.types.attrsOf (lib.types.submodule ({ config, ... }: { + options = { + rule = lib.mkOption { + type = lib.types.str; + default = config._module.args.name; + }; + default = lib.mkOption { + type = lib.types.bool; + default = !config.parents; + }; + recursive = lib.mkOption { + type = lib.types.bool; + default = !config.parents; + }; + parents = lib.mkOption { + type = lib.types.bool; + default = false; + description = '' + apply ACL to every parent folder + ''; + }; + }; + }))); + default = {}; + }; + config = { + systemd.services = lib.mapAttrs' (path: rules: lib.nameValuePair "acl-${lib.replaceChars ["/"] ["_"] path}" { + wantedBy = [ "multi-user.target" ]; + path = [ + pkgs.acl + pkgs.coreutils + ]; + serviceConfig = { + ExecStart = pkgs.writers.writeDash "acl" (lib.concatStrings ( + lib.mapAttrsToList (_: rule: '' + setfacl -${lib.optionalString rule.recursive "R"}m ${rule.rule} ${path} + ${lib.optionalString rule.default "setfacl -${lib.optionalString rule.recursive "R"}dm ${rule.rule} ${path}"} + ${lib.optionalString rule.parents (lib.concatMapStringsSep "\n" (folder: "setfacl -m ${rule.rule} ${folder}") (parents path))} + '') rules + )); + RemainAfterExit = true; + Type = "simple"; + }; + }) config.krebs.acl; + }; +} |