gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-10 04:49:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(cloudflared): explicit user

Browse source
This commit is contained in:
arcnmx 2025-09-17 14:32:14 -07:00
parent d80fd6fd5f
commit e0fe5bcd6f
4 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
modules/nixos/cloudflared.nix
View file

@ -2,9 +2,11 @@ let
tunnelModule = { tunnelModule = {
pkgs, pkgs,
config, config,
gensokyo-zone,
lib, lib,
... ...
}: let }: let
inherit (gensokyo-zone.lib) unmerged;
inherit (lib.options) mkOption mkEnableOption; inherit (lib.options) mkOption mkEnableOption;
settingsFormat = pkgs.formats.json {}; settingsFormat = pkgs.formats.json {};
in { in {
@ -24,6 +26,10 @@ let
default = {}; default = {};
}; };
}; };
systemd.extraServiceSettings = mkOption {
type = unmerged.types.attrs;
default = {};
};
}; };
}; };
in in
@ -35,6 +41,7 @@ in
lib, lib,
... ...
}: let }: let
inherit (gensokyo-zone.lib) unmerged;
inherit (lib.attrsets) mapAttrsToList mapAttrs' nameValuePair filterAttrsRecursive; inherit (lib.attrsets) mapAttrsToList mapAttrs' nameValuePair filterAttrsRecursive;
inherit (lib.lists) singleton; inherit (lib.lists) singleton;
inherit (lib.modules) mkIf mkMerge mkForce; inherit (lib.modules) mkIf mkMerge mkForce;
@ -63,6 +70,10 @@ in
}; };
}); });
}; };
systemd.extraServiceSettings = mkOption {
type = unmerged.types.attrs;
default = {};
};
}; };
config.services.cloudflared = { config.services.cloudflared = {
extraArgs = mkIf (cfg.metricsPort != null) [ extraArgs = mkIf (cfg.metricsPort != null) [
@ -112,6 +123,8 @@ in
]; ];
}; };
} }
(unmerged.mergeAttrs tunnel.systemd.extraServiceSettings)
(unmerged.mergeAttrs cfg.systemd.extraServiceSettings)
(mkIf tunnel.extraTunnel.enable { (mkIf tunnel.extraTunnel.enable {
serviceConfig = { serviceConfig = {
inherit RuntimeDirectory; inherit RuntimeDirectory;

7
nixos/cloudflared.nix
View file

@ -11,6 +11,9 @@ in {
enable = mkDefault true; enable = mkDefault true;
metricsPort = mkDefault 3011; metricsPort = mkDefault 3011;
metricsBind = "[::]"; metricsBind = "[::]";
systemd.extraServiceSettings = {
serviceConfig.User = mkDefault "cloudflared";
};
}; };
users = mkIf cfg.enable { users = mkIf cfg.enable {
users.cloudflared = { users.cloudflared = {
@ -26,8 +29,8 @@ in {
}; };
boot.kernel.sysctl = mkIf (!config.boot.isContainer && cfg.enable) { boot.kernel.sysctl = mkIf (!config.boot.isContainer && cfg.enable) {
# https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
"net.core.rmem_max" = mkDefault 2500000; "net.core.rmem_max" = mkDefault 7500000;
"net.core.wmem_max" = mkDefault 2500000; "net.core.wmem_max" = mkDefault 7500000;
}; };
}; };
} }

4
systems/meiling/sysctl.50-net.conf
View file

@ -1,5 +1,5 @@
net.ipv4.ping_group_range=0 2147483647 net.ipv4.ping_group_range=0 2147483647
net.ipv4.ip_forward=1 net.ipv4.ip_forward=1
# https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
net.core.rmem_max=2500000 net.core.rmem_max=7500000
net.core.wmem_max=2500000 net.core.wmem_max=7500000

4
systems/reisen/sysctl.50-net.conf
View file

@ -3,5 +3,5 @@ net.ipv6.conf.vmbr0.use_tempaddr=1
net.ipv6.conf.vmbr0.accept_ra_rt_info_max_plen=128 net.ipv6.conf.vmbr0.accept_ra_rt_info_max_plen=128
net.ipv4.ping_group_range=0 2147483647 net.ipv4.ping_group_range=0 2147483647
# https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes # https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
net.core.rmem_max=2500000 net.core.rmem_max=7500000
net.core.wmem_max=2500000 net.core.wmem_max=7500000