SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 14:01:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Deduplicate unprotected service messages via mkUnprotectedMessage

Browse source
This commit is contained in:
SebastianStork 2025-10-21 22:52:44 +02:00
parent 464b6a7850
commit 66d5263aca
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
4 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/default.nix
View file

@ -12,4 +12,7 @@ lib: {
path: path |> builtins.readDir |> lib.filterAttrs (_: type: type == "directory") |> lib.attrNames; path: path |> builtins.readDir |> lib.filterAttrs (_: type: type == "directory") |> lib.attrNames;
genAttrs = f: names: lib.genAttrs names f; genAttrs = f: names: lib.genAttrs names f;
mkUnprotectedMessage =
name: "${name} should only be exposed on private networks; access control isn't yet configured";
} }

6
modules/system/services/syncthing.nix
View file

@ -43,17 +43,13 @@ in
assertion = config.custom.services.tailscale.enable; assertion = config.custom.services.tailscale.enable;
message = "Syncthing requires tailscale."; message = "Syncthing requires tailscale.";
} }
{
assertion = cfg.doBackups -> cfg.isServer;
message = "Syncthing backups should only be performed on a server.";
}
{ {
assertion = cfg.isServer -> (cfg.gui.domain != null); assertion = cfg.isServer -> (cfg.gui.domain != null);
message = "Running syncthing on a server requires `gui.domain` to be set."; message = "Running syncthing on a server requires `gui.domain` to be set.";
} }
{ {
assertion = (cfg.gui.domain != null) -> (lib'.isTailscaleDomain cfg.gui.domain); assertion = (cfg.gui.domain != null) -> (lib'.isTailscaleDomain cfg.gui.domain);
message = "The syncthing gui should only be exposed on a private network as it isn't yet configured with access controll."; message = lib'.mkUnprotectedMessage "Syncthing-GUI";
} }
]; ];

2
modules/system/web-services/filebrowser.nix
View file

@ -31,7 +31,7 @@ in
assertions = [ assertions = [
{ {
assertion = lib'.isTailscaleDomain cfg.domain; assertion = lib'.isTailscaleDomain cfg.domain;
message = "Filebrowser isn't yet configured with access controll."; message = lib'.mkUnprotectedMessage "Filebrowser";
} }
{ {
assertion = !lib.pathExists "${modulesPath}/services/web-apps/filebrowser.nix"; assertion = !lib.pathExists "${modulesPath}/services/web-apps/filebrowser.nix";

2
modules/system/web-services/freshrss.nix
View file

@ -25,7 +25,7 @@ in
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
assertions = lib.singleton { assertions = lib.singleton {
assertion = lib'.isTailscaleDomain cfg.domain; assertion = lib'.isTailscaleDomain cfg.domain;
message = "FreshRSS isn't configured with access controll."; message = lib'.mkUnprotectedMessage "FreshRSS";
}; };
meta = { meta = {