chore: nix fmt
This commit is contained in:
parent
a80bd4ed3b
commit
7266fff06e
128 changed files with 3402 additions and 2013 deletions
|
@ -1,4 +1,10 @@
|
|||
{ pkgs, lib, config, ... }: let
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) mapAttrs' nameValuePair;
|
||||
|
||||
servers = {
|
||||
|
@ -25,81 +31,100 @@
|
|||
|
||||
prefix = "minecraft-server-";
|
||||
data = "/nix/persist/service/minecraft";
|
||||
in {
|
||||
in
|
||||
{
|
||||
# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/games/minecraft-server.nix
|
||||
users.users.minecraft = {
|
||||
description = "Minecraft server service user";
|
||||
home = data;
|
||||
createHome = true;
|
||||
isSystemUser = true;
|
||||
uid = 1021;
|
||||
group = "minecraft";
|
||||
description = "Minecraft server service user";
|
||||
home = data;
|
||||
createHome = true;
|
||||
isSystemUser = true;
|
||||
uid = 1021;
|
||||
group = "minecraft";
|
||||
};
|
||||
users.groups.minecraft.gid = 1021;
|
||||
|
||||
systemd.sockets = mapAttrs' (name: value: with value; (nameValuePair "${prefix}${name}" {
|
||||
bindsTo = [ "${prefix}${name}.service" ];
|
||||
socketConfig = {
|
||||
ListenFIFO = "/run/minecraft-server/${name}.stdin";
|
||||
SocketMode = "0660";
|
||||
SocketUser = "minecraft";
|
||||
SocketGroup = "minecraft";
|
||||
RemoveOnStop = true;
|
||||
FlushPending = true;
|
||||
};
|
||||
})) servers;
|
||||
systemd.sockets = mapAttrs' (
|
||||
name: value:
|
||||
with value;
|
||||
(nameValuePair "${prefix}${name}" {
|
||||
bindsTo = [ "${prefix}${name}.service" ];
|
||||
socketConfig = {
|
||||
ListenFIFO = "/run/minecraft-server/${name}.stdin";
|
||||
SocketMode = "0660";
|
||||
SocketUser = "minecraft";
|
||||
SocketGroup = "minecraft";
|
||||
RemoveOnStop = true;
|
||||
FlushPending = true;
|
||||
};
|
||||
})
|
||||
) servers;
|
||||
|
||||
systemd.services = let
|
||||
stopScript = { name, stop }: pkgs.writeShellScript "minecraft-server-stop" ''
|
||||
echo ${stop} > ${config.systemd.sockets."${prefix}${name}".socketConfig.ListenFIFO}
|
||||
systemd.services =
|
||||
let
|
||||
stopScript =
|
||||
{ name, stop }:
|
||||
pkgs.writeShellScript "minecraft-server-stop" ''
|
||||
echo ${stop} > ${config.systemd.sockets."${prefix}${name}".socketConfig.ListenFIFO}
|
||||
|
||||
# Wait for the PID of the minecraft server to disappear before
|
||||
# returning, so systemd doesn't attempt to SIGKILL it.
|
||||
while kill -0 "$1" 2> /dev/null; do
|
||||
sleep 1s
|
||||
done
|
||||
'';
|
||||
in mapAttrs' (name: value: with value; (nameValuePair "${prefix}${name}" {
|
||||
description = "Minecraft Server Service for ${name}";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
requires = [ "${prefix}${name}.socket" ];
|
||||
after = [ "network.target" "${prefix}${name}.socket" ];
|
||||
path = [ pkgs.bash ];
|
||||
# Wait for the PID of the minecraft server to disappear before
|
||||
# returning, so systemd doesn't attempt to SIGKILL it.
|
||||
while kill -0 "$1" 2> /dev/null; do
|
||||
sleep 1s
|
||||
done
|
||||
'';
|
||||
in
|
||||
mapAttrs' (
|
||||
name: value:
|
||||
with value;
|
||||
(nameValuePair "${prefix}${name}" {
|
||||
description = "Minecraft Server Service for ${name}";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
requires = [ "${prefix}${name}.socket" ];
|
||||
after = [
|
||||
"network.target"
|
||||
"${prefix}${name}.socket"
|
||||
];
|
||||
path = [ pkgs.bash ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = cmdline;
|
||||
ExecStop = "${stopScript { inherit name stop; }} $MAINPID";
|
||||
Restart = "always";
|
||||
User = "minecraft";
|
||||
WorkingDirectory = "${data}/${name}";
|
||||
serviceConfig = {
|
||||
ExecStart = cmdline;
|
||||
ExecStop = "${stopScript { inherit name stop; }} $MAINPID";
|
||||
Restart = "always";
|
||||
User = "minecraft";
|
||||
WorkingDirectory = "${data}/${name}";
|
||||
|
||||
StandardInput = "socket";
|
||||
StandardOutput = "journal";
|
||||
StandardError = "journal";
|
||||
StandardInput = "socket";
|
||||
StandardOutput = "journal";
|
||||
StandardError = "journal";
|
||||
|
||||
# Hardening
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DeviceAllow = [ "" ];
|
||||
LockPersonality = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
UMask = "0077";
|
||||
};
|
||||
})) servers;
|
||||
# Hardening
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DeviceAllow = [ "" ];
|
||||
LockPersonality = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
UMask = "0077";
|
||||
};
|
||||
})
|
||||
) servers;
|
||||
|
||||
global.fs.zfs.mountpoints.${data} = "service/minecraft";
|
||||
networking.firewall.allowedTCPPorts = [ 25565 ];
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue