cntlm service: cleanup non working config options #26578
Conversation
| name = "cntlm"; | ||
| description = "cntlm system-wide daemon"; | ||
| home = "/var/empty"; | ||
| uid = config.ids.uids.cntlm; |
There was a problem hiding this comment.
What is it intended to accomplish?
There was a problem hiding this comment.
There's no need to hard-code uids; if none is provided, the system allocates one upon activation.
There was a problem hiding this comment.
What's the goal of the uid list then? I always thought it was to make the system reproducible. But from a service point of view there is no need for a hard coded url.
There was a problem hiding this comment.
It permits referring to a user before the uid/name mapping is established and helps improve data portability (between NixOS hosts). If the service doesn't generate any interesting data and you don't need to refer to its user by uid, a static mapping is just clutter.
There was a problem hiding this comment.
Thanks for the explanation. I change the PR to create the user as system user without a fixed uid.
There was a problem hiding this comment.
Note that this is a generic comment; I don't know anything about cntlm in particular. It's not as if you can't use static uids, just that there should be a considered reason for it :)
There was a problem hiding this comment.
No the service really just runs as a proxy and doesn't produce any data. I can't think of a reason it needs a static uid. I was just not aware of the best practice.
There was a problem hiding this comment.
the problem with automatically allocated UIDs/GIDs is that once they are freed they are instantly reused by other dynamically allocated services. there is no smart allocation strategy as round robin or similar yet which means that sometimes newly created users can access data from deceased users.
- extraConfig was not working - add possibility to add cntlm.conf in verbatime form - create cntlm user as system user - add no proxy option
Motivation for this change
The current module configs were not working correctly.
Things done
(nix.useSandbox on NixOS,
or option
build-use-sandboxinnix.confon non-NixOS)
nix-shell -p nox --run "nox-review wip"./result/bin/)