Dawoox/nixpkgs
1
1
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

nixos/tsidp: pass dir flag to avoid state being created in $HOME/.config (#452238)

Browse Source
This commit is contained in:
h7x4
2025-10-15 13:51:48 +00:00
committed by GitHub
parent af0bfe2d3a fd20b1b44b
commit 22244d965a
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
nixos/modules/services/security/tsidp.nix
View File

@@ -23,6 +23,8 @@ let
nullOr nullOr
; ;
stateDir = "/var/lib/tsidp";
cfg = config.services.tsidp; cfg = config.services.tsidp;
in in
{ {
@@ -154,7 +156,7 @@ in
]; ];
environment = { environment = {
HOME = "/var/lib/tsidp"; HOME = stateDir;
TAILSCALE_USE_WIP_CODE = "1"; # Needed while tsidp is in development (< v1.0.0). TAILSCALE_USE_WIP_CODE = "1"; # Needed while tsidp is in development (< v1.0.0).
}; };
@@ -163,6 +165,7 @@ in
ExecStart = ExecStart =
let let
args = lib.cli.toGNUCommandLineShell { mkOptionName = k: "-${k}"; } { args = lib.cli.toGNUCommandLineShell { mkOptionName = k: "-${k}"; } {
dir = stateDir;
hostname = cfg.settings.hostName; hostname = cfg.settings.hostName;
port = cfg.settings.port; port = cfg.settings.port;
local-port = cfg.settings.localPort; local-port = cfg.settings.localPort;
@@ -179,8 +182,8 @@ in
RestartSec = "15"; RestartSec = "15";
DynamicUser = true; DynamicUser = true;
StateDirectory = "tsidp"; StateDirectory = baseNameOf stateDir;
WorkingDirectory = "/var/lib/tsidp"; WorkingDirectory = stateDir;
ReadWritePaths = mkIf (cfg.settings.useLocalTailscaled) [ ReadWritePaths = mkIf (cfg.settings.useLocalTailscaled) [
"/var/run/tailscale" # needed due to `ProtectSystem = "strict";` "/var/run/tailscale" # needed due to `ProtectSystem = "strict";`
"/var/lib/tailscale" "/var/lib/tailscale"