Commit Graph

9 Commits

Author SHA1 Message Date
Dominique Martinet
829c611b48 logrotate: add logrotate-checkconf.service
the build-time check is not safe (e.g. doesn't protect from bad users or nomissingok
paths missing), so add a new unit for configuration switch time check
2022-04-01 07:09:27 +09:00
Dominique Martinet
45ef5c1741 logrotate: add configuration check at build time
Now the service no longer starts immediately,
check if the config we generated makes sense as soon as possible.

The check isn't perfect because logrotate --debug wants to check
users required, there are two problems:
 - /etc/passwd and /etc/group are sandboxed and we don't have
visibility of system users
 - the check phase runs as nixbld which cannot su to other users
and logrotate fails on this

Until these two problems can be addressed, users-related checks
are filtered out, it's still much better than no check.
The check can be disabled with services.logrotate.checkConfig
if required
(bird also has a preCheck param, to prepare the environment
before check, but we can add it if it becomes necessary)

Since this makes for very verbose builds, we only show errors:
There is no way to control log level, but logrotate hardcodes
'error:' at common log level, so we can use grep, taking care
to keep error codes

Some manual tests:
───────┬──────────────────────────────────────────
       │ File: valid-config.conf
───────┼──────────────────────────────────────────
   1   │ missingok
───────┴──────────────────────────────────────────
logrotate --debug ok
grep ok

───────┬──────────────────────────────────────────
       │ File: postrotate-no-end.conf
───────┼──────────────────────────────────────────
   1   │ missingok
   2   │ /file {
   3   │    postrotate
   4   │      test
   5   │ }
───────┴──────────────────────────────────────────
error: postrotate-no-end.conf:prerotate, postrotate or preremove without endscript

───────┬──────────────────────────────────────────
       │ File: missing-file.conf
───────┼──────────────────────────────────────────
   1   │ "test" { daily }
───────┴──────────────────────────────────────────
error: stat of test failed: No such file or directory

───────┬──────────────────────────────────────────
       │ File: unknown-option.conf
───────┼──────────────────────────────────────────
   1   │ some syntax error
───────┴──────────────────────────────────────────
logrotate --debug ok
error: unknown-option.conf:1 unknown option 'some' -- ignoring line

───────┬──────────────────────────────────────────
       │ File: unknown-user.conf
───────┼──────────────────────────────────────────
   1   │ su notauser notagroup
───────┴──────────────────────────────────────────
error: unknown-user.conf:1 unknown user 'notauser'

In particular note that logrotate would not error on unknown option
(it just ignores the line) but this change makes the check fail.
2022-04-01 07:09:27 +09:00
Dominique Martinet
e92c05349c nixos/logrotate: convert to freeform
using freeform is the new standard way of using modules and should replace
extraConfig.
In particular, this will allow us to place a condition on mails
2022-04-01 07:09:26 +09:00
Dominique Martinet
b457d917dc logrotate: move mail dependency from package to service
having pkgs.logrotate depend on mailutils brings in quite a bit of dependencies
through mailutil itself and recursive dependency to guile when most people
do not need it.

Remove mailutils dependency from the package, and conditionally add it to the
service if the user specify the mail option either at top level or in a path

Fixes #162001
2022-04-01 07:09:24 +09:00
Robert Hensing
aa0f27abb0 treewide: machine -> nodes.machine 2022-03-28 14:11:58 +02:00
Janne Heß
d32ba3f4b0
Merge pull request #161929 from martinetd/switchTest
logrotate: do not enable logrotate.service itself
2022-02-28 10:19:25 +01:00
Dominique Martinet
0dadec45d8 logrotate/systemd: add 'minsize = 1M' to wtmp/btmp rotation
align with upstream logrotate which added the minsize rule at some point.
This avoids needlessly rotating the files too often as brought up in
https://github.com/NixOS/nixpkgs/pull/159187#issuecomment-1052426774
2022-02-27 07:20:26 +09:00
Dominique Martinet
4d12b79cd7 logrotate: do not enable logrotate.service itself
logrotate.timer is enough for rotating logs. Enabling logrotate.service would
make the service start on every configuration switch, leading to tests failure when
logrotate is enabled.

Also update test to make sure the timer is active and runs the service
on date change.
2022-02-26 19:13:12 +09:00
Dominique Martinet
a05f1c9f93 nixos tests: add logrotate test
make sure the service is enabled by default and works.
2022-02-13 07:29:40 +09:00