Run hydra-server under a separate UID
Also, keep state in /var/lib/{hydra,hydra-server}. /var/lib/hydra is readable, but not writable, to the hydra group (which includes hydra-server).
Eelco Dolstra committed
Feb 24, 2015 at 13:06 UTC
699eeb06640446079486d3fc1ebba5d27b372a8d
2 files changed
+39
-51
delft/hydra.nix
+36
-35
@@ -6,7 +6,7 @@ let
6
7
cfg = config.services.hydra;
8
9
- hydra = "/home/hydra/.nix-profile"; # FIXME
9
+ hydra = "/nix/var/nix/profiles/per-user/hydra/profile"; # FIXME
10
11
hydraConf = pkgs.writeScript "hydra.conf"
12
''
@@ -29,15 +29,15 @@ let
29
{ NIX_REMOTE = "daemon";
30
NIX_CONF_DIR = "/etc/nix";
31
HYDRA_DBI = cfg.dbi;
32
- HYDRA_CONFIG = "${cfg.baseDir}/data/hydra.conf";
33
- HYDRA_DATA = "${cfg.baseDir}/data";
34
- #HOME = "/home/hydra";
35
- OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
32
+ HYDRA_CONFIG = hydraConf;
33
+ HYDRA_DATA = cfg.baseDir;
34
+ OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
35
};
36
37
serverEnv = env //
38
{ HYDRA_LOGO = cfg.logo;
40
- #HYDRA_TRACKER = cfg.tracker; # FIXME: needs escaping (or should be read from a file)
39
+ HYDRA_SERVER_DATA = "/var/lib/hydra-server";
40
+ COLUMNS = "80";
41
};
42
43
in
@@ -57,19 +57,12 @@ in
57
};
58
59
baseDir = mkOption {
60
- default = "/home/${user.default}";
60
+ default = "/var/lib/hydra";
61
description = ''
62
The directory holding configuration, logs and temporary files.
63
'';
64
};
65
66
- user = mkOption {
67
- default = "hydra";
68
- description = ''
69
- The user the Hydra services should run as.
70
- '';
71
- };
72
-
66
dbi = mkOption {
67
default = "dbi:Pg:dbname=hydra;host=wendy;user=hydra;";
68
description = ''
@@ -105,13 +98,6 @@ in
98
'';
99
};
100
108
- tracker = mkOption {
109
- default = "";
110
- description = ''
111
- Piece of HTML that is included on all pages.
112
- '';
113
- };
114
-
101
logo = mkOption {
102
default = "";
103
description = ''
@@ -128,14 +114,24 @@ in
114
115
config = mkIf cfg.enable {
116
131
- users.extraUsers = singleton
132
- { name = cfg.user;
133
- description = "Hydra";
134
- home = cfg.baseDir;
117
+ users.extraUsers.hydra =
118
+ { description = "Hydra";
119
+ group = "hydra";
120
createHome = true;
121
+ home = "/home/hydra";
122
useDefaultShell = true;
123
};
124
125
+ users.extraUsers.hydra-server =
126
+ { description = "Hydra Web Server";
127
+ group = "hydra";
128
+ createHome = true;
129
+ home = "/home/hydra-server";
130
+ useDefaultShell = true;
131
+ };
132
+
133
+ users.extraGroups.hydra = { };
134
+
135
nix.maxJobs = 0;
136
nix.distributedBuilds = true;
137
@@ -163,9 +159,8 @@ in
159
jobs."hydra-init" =
160
{ wantedBy = [ "multi-user.target" ];
161
script = ''
166
- mkdir -p ${cfg.baseDir}/data
167
- chown ${cfg.user} ${cfg.baseDir}/data
168
- ln -sf ${hydraConf} ${cfg.baseDir}/data/hydra.conf
162
+ mkdir -m 0750 -p ${cfg.baseDir}
163
+ chown hydra.hydra ${cfg.baseDir}
164
'';
165
task = true;
166
};
@@ -174,10 +169,16 @@ in
169
{ wantedBy = [ "multi-user.target" ];
170
wants = [ "hydra-init.service" ];
171
after = [ "hydra-init.service" ];
177
- environment = serverEnv // { COLUMNS = "80"; };
172
+ environment = serverEnv;
173
+ preStart =
174
+ ''
175
+ mkdir -m 0700 -p /var/lib/hydra-server
176
+ chown hydra-server.hydra /var/lib/hydra-server
177
+ '';
178
serviceConfig =
179
{ ExecStart = "@${hydra}/bin/hydra-server hydra-server -f -h \* --max_spare_servers 5 --max_servers 25 --max_requests 100";
180
- User = cfg.user;
180
+ User = "hydra-server";
181
+ PermissionsStartOnly = true;
182
Restart = "always";
183
};
184
};
@@ -192,20 +193,20 @@ in
193
{ ExecStartPre = "${hydra}/bin/hydra-queue-runner --unlock";
194
ExecStart = "@${hydra}/bin/hydra-queue-runner hydra-queue-runner";
195
ExecStopPost = "${hydra}/bin/hydra-queue-runner --unlock";
195
- User = cfg.user;
196
+ User = "hydra";
197
Restart = "always";
198
};
199
};
200
201
systemd.services."hydra-evaluator" =
201
- { wantedBy = [ "multi-user.target" ];
202
+ { #wantedBy = [ "multi-user.target" ];
203
wants = [ "hydra-init.service" ];
204
after = [ "hydra-init.service" "network.target" ];
205
path = [ pkgs.nettools pkgs.ssmtp ];
206
environment = env;
207
serviceConfig =
208
{ ExecStart = "@${hydra}/bin/hydra-evaluator hydra-evaluator";
208
- User = cfg.user;
209
+ User = "hydra";
210
Restart = "always";
211
};
212
};
@@ -216,7 +217,7 @@ in
217
environment = env;
218
serviceConfig =
219
{ ExecStart = "@${hydra}/bin/hydra-update-gc-roots hydra-update-gc-roots";
219
- User = cfg.user;
220
+ User = "hydra";
221
};
222
};
223
@@ -235,7 +236,7 @@ in
236
fi
237
'';
238
in
238
- [ "*/5 * * * * root ${checkSpace} &> ${cfg.baseDir}/data/checkspace.log"
239
+ [ "*/5 * * * * root ${checkSpace} &> ${cfg.baseDir}/checkspace.log"
240
"15 2,14 * * * root ${pkgs.systemd}/bin/systemctl start hydra-update-gc-roots.service"
241
];
242
delft/lucifer.nix
+3
-16
@@ -31,22 +31,6 @@
31
32
services.hydra.enable = true;
33
services.hydra.logo = ./hydra-logo.png;
34
- services.hydra.tracker = ''
35
- <!-- Start of StatCounter Code -->
36
- <script type=\"text/javascript\">
37
- var sc_project=6818408;
38
- var sc_invisible=1;
39
- var sc_security=\"8838c8ed\";
40
- </script>
41
- <script type=\"text/javascript\"
42
- src=\"http://www.statcounter.com/counter/counter.js\"></script>
43
- <noscript><div class=\"statcounter\"><a title=\"visit tracker
44
- on tumblr\" href=\"http://statcounter.com/tumblr/\"
45
- target=\"_blank\"><img class=\"statcounter\"
46
- src=\"http://c.statcounter.com/6818408/0/8838c8ed/1/\"
47
- alt=\"visit tracker on tumblr\"></a></div></noscript>
48
- <!-- End of StatCounter Code -->
49
- '';
34
35
fileSystems."/".device = "/dev/disk/by-label/nixos";
36
@@ -124,6 +108,9 @@
108
startAt = "Sun 01:45";
109
};
110
111
+ users.extraUsers.hydra.openssh.authorizedKeys.keys = with import ../ssh-keys.nix; [ eelco rob ];
112
+ users.extraUsers.hydra-server.openssh.authorizedKeys.keys = with import ../ssh-keys.nix; [ eelco rob ];
113
+
114
users.extraUsers.rbvermaa =
115
{ description = "Rob Vermaas";
116
home = "/home/rbvermaa";