SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 14:01:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Deduplicate unprotected service messages via mkUnprotectedMessage

Browse source
This commit is contained in:
SebastianStork 2025-10-21 22:52:44 +02:00
parent 464b6a7850
commit 66d5263aca
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
4 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/default.nix
View file

@ -12,4 +12,7 @@ lib: {
path: path |> builtins.readDir |> lib.filterAttrs (_: type: type == "directory") |> lib.attrNames;
genAttrs = f: names: lib.genAttrs names f;
mkUnprotectedMessage =
name: "${name} should only be exposed on private networks; access control isn't yet configured";
}

6
modules/system/services/syncthing.nix
View file

@ -43,17 +43,13 @@ in
assertion = config.custom.services.tailscale.enable;
message = "Syncthing requires tailscale.";
}
{
assertion = cfg.doBackups -> cfg.isServer;
message = "Syncthing backups should only be performed on a server.";
}
{
assertion = cfg.isServer -> (cfg.gui.domain != null);
message = "Running syncthing on a server requires `gui.domain` to be set.";
}
{
assertion = (cfg.gui.domain != null) -> (lib'.isTailscaleDomain cfg.gui.domain);
message = "The syncthing gui should only be exposed on a private network as it isn't yet configured with access controll.";
message = lib'.mkUnprotectedMessage "Syncthing-GUI";
}
];

2
modules/system/web-services/filebrowser.nix
View file

@ -31,7 +31,7 @@ in
assertions = [
{
assertion = lib'.isTailscaleDomain cfg.domain;
message = "Filebrowser isn't yet configured with access controll.";
message = lib'.mkUnprotectedMessage "Filebrowser";
}
{
assertion = !lib.pathExists "${modulesPath}/services/web-apps/filebrowser.nix";

2
modules/system/web-services/freshrss.nix
View file

@ -25,7 +25,7 @@ in
config = lib.mkIf cfg.enable {
assertions = lib.singleton {
assertion = lib'.isTailscaleDomain cfg.domain;
message = "FreshRSS isn't configured with access controll.";
message = lib'.mkUnprotectedMessage "FreshRSS";
};
meta = {