From 84ad0b0a93eccdef0e4ca05fd4091f014cb1ac25 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 17 Apr 2019 20:45:33 +0200
Subject: krebs.permown: init

Derived from lass/3modules/ensure-permissions.nix
---
 krebs/3modules/default.nix |  1 +
 krebs/3modules/permown.nix | 74 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 krebs/3modules/permown.nix

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 567c077eb..4d40f3856 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -39,6 +39,7 @@ let
       ./nixpkgs.nix
       ./on-failure.nix
       ./os-release.nix
+      ./permown.nix
       ./per-user.nix
       ./power-action.nix
       ./Reaktor.nix
diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix
new file mode 100644
index 000000000..7a86013e1
--- /dev/null
+++ b/krebs/3modules/permown.nix
@@ -0,0 +1,74 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: {
+
+  options.krebs.permown = mkOption {
+    default = [];
+    type = types.listOf (types.submodule {
+      options = {
+        directory-mode = mkOption {
+          default = "=rwx";
+          type = types.str; # TODO
+        };
+        file-mode = mkOption {
+          default = "=rw";
+          type = types.str; # TODO
+        };
+        group = mkOption {
+          apply = x: if x == null then "" else x;
+          default = null;
+          type = types.nullOr types.groupname;
+        };
+        owner = mkOption {
+          type = types.username;
+        };
+        path = mkOption {
+          type = types.absolute-pathname;
+        };
+        umask = mkOption {
+          default = "0027";
+          type = types.file-mode;
+        };
+      };
+    });
+  };
+
+  config.systemd.services = genAttrs' config.krebs.permown (plan: {
+    name = "permown.${replaceStrings ["/"] ["_"] plan.path}";
+    value = {
+      environment = {
+        DIR_MODE = plan.directory-mode;
+        FILE_MODE = plan.file-mode;
+        OWNER_GROUP = "${plan.owner}:${plan.group}";
+        ROOT_PATH = plan.path;
+      };
+      path = [
+        pkgs.coreutils
+        pkgs.findutils
+        pkgs.inotifyTools
+      ];
+      serviceConfig = {
+        ExecStart = pkgs.writeDash "permown" ''
+          set -efu
+
+          find "$ROOT_PATH" -exec chown "$OWNER_GROUP" {} +
+          find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} +
+          find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} +
+
+          inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" |
+          while read -r path; do
+            if test -d "$path"; then
+              exec "$0" "$@"
+            fi
+            chown "$OWNER_GROUP" "$path"
+            chmod "$FILE_MODE" "$path"
+          done
+        '';
+        Restart = "always";
+        RestartSec = 10;
+        UMask = plan.umask;
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+  });
+
+}
-- 
cgit v1.2.3