How to override protecthome on caddy

hansemschnokeloch · February 8, 2023, 3:30pm

Hello,

I currently have a complete dev stack setup made with docker, and I want to learn how to do the same in the nix way step by step.

First step : I want to use caddy as a local webserver, but my vhosts directories are located under my home directory.
Caddy package has a default systemd protectHome configuration set to “true” and therefore serving files located under my home directory ends up with a 403 forbidden error.

Question : how can I override this protectHome configuration ?

github.com

NixOS/nixpkgs/blob/af96094e9b8eb162d70a84fa3b39f4b7a8b264d2/nixos/modules/services/web-servers/caddy/default.nix#L322

    
      
              User = cfg.user;
              Group = cfg.group;
              ReadWriteDirectories = cfg.dataDir;
              StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
              LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
              Restart = "on-abnormal";
          
          
    # TODO: attempt to upstream these options
              NoNewPrivileges = true;
              PrivateDevices = true;
              ProtectHome = true;
            };
          };
          
          
users.users = optionalAttrs (cfg.user == "caddy") {
            caddy = {
              group = cfg.group;
              uid = config.ids.uids.caddy;
              home = cfg.dataDir;
            };
          };

Thx

nurelin · February 8, 2023, 7:18pm

Hello,

systemd.services.caddy.serviceConfig.ProtectHome = lib.mkForce false; should work.

hansemschnokeloch · February 8, 2023, 7:55pm

Thx nurelin, it works !