dnsmasq nixos: make sure it always runs #30319
Conversation
| PrivateTmp = true; | ||
| ProtectSystem = true; | ||
| ProtectHome = true; | ||
| Restart = "always"; |
There was a problem hiding this comment.
How about Restart = "on-failure";?
There was a problem hiding this comment.
In general I think Restart = "on-failure"; should be applied but as dnsmasq is a pretty critical piece of infrastructure, it should probably be running the whole time even if manually shut down.
You can very easily argue though that this is a policy we shouldn't be setting for our users.
Would you feel more comfortable if I made that a configuration setting?
There was a problem hiding this comment.
I don't think this needs to be configurable:
systemd.services.dnsmasq.serviceConfig.Restart = "always";
is simple enough.
Under which circumstances dnsmasq shuts down itself gracefully, when it should not? Sounds like the bug is somewhere else?
There was a problem hiding this comment.
Indeed - if it exits with 0, we probably still want it to restart - it should simply be running all the time. Bug or no bug.
By default we only restart if the dnsmasq daemon fails but we introduce an option to always keep it running.
Motivation for this change
If dnsmasq has been enabled, we probably want to do what we can to make sure it keeps running so we always restart it.
Also lock down the service a bit.
Cc: @fpletz
Things done
build-use-sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)