From 0973ca006cea610f1d0e060ceb3448c051b9e20e Mon Sep 17 00:00:00 2001 From: William Carroll Date: Sun, 23 Feb 2020 20:01:33 +0000 Subject: Define monzo-token-server as a root systemd service After I considered the security implications of calling `systemctl --user cat monzo-token-server`, I realized that monzo-token-server should be a root service instead of a user service. This service unit now also explicitly depends on briefcase.monzo_ynab.tokens, which is a big improvement. --- nixos/configuration.nix | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'nixos/configuration.nix') diff --git a/nixos/configuration.nix b/nixos/configuration.nix index f98fe980ec7e..54fd8f3ea2a5 100644 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -1,4 +1,8 @@ -{ pkgs ? import {}, ... }: +{ + pkgs ? import {}, + briefcase ? import {}, + ... +}: let trimNewline = x: pkgs.lib.removeSuffix "\n" x; @@ -75,11 +79,14 @@ in { services.lorri.enable = true; - systemd.user.services.monzo-token-server = { + systemd.services.monzo-token-server = { enable = true; description = "Ensure my Monzo access token is valid"; - script = "/home/wpcarro/.nix-profile/bin/token-server"; + script = "${briefcase.monzo_ynab.tokens}/bin/token-server"; + # TODO(wpcarro): I'm unsure of the size of this security risk, but if a + # non-root user runs `systemctl cat monzo-token-server`, they could read the + # following, sensitive environment variables. environment = { store_path = "/var/cache/monzo_ynab"; monzo_client_id = readSecret "monzo-client-id"; @@ -90,7 +97,6 @@ in { }; serviceConfig = { - WorkingDirectory = "%h/briefcase/monzo_ynab"; Type = "simple"; }; }; -- cgit 1.4.1