miniupnpd: add service

[jgillich]

Not sure if there are any more common config options to add.

[mention-bot]

By analyzing the blame information on this pull request, we identified @edolstra, @bjornfor and @offlinehacker to be potential reviewers

[jagajaga]

Please use mkEnableOption.

[jgillich]

@jagajaga Thanks, based all of this on another service so I had no idea mkEnableOption even exists. Is there documentation for them or where can I find them in the source tree?

Anyway, all fixed, also fixed the descriptions that made no sense.

[jagajaga]

As an argument you need to write just the name of option :)
In this case you need to write just the name of service.
You can search through nixpkgs and find some examples.

[jgillich]

Oh I did look at examples, but seem to have missed that. ;)

[jgillich]

Btw why is there no mkDisableOption as a shorthand for default = true?

[jgillich]

Please don't merge yet, the -d option is really verbose, I need to change it to use the PID file.

[zimbatm]

Is it possible to run miniupnpd in it's own user instead of root ?

[jgillich]

@zimbatm You tell me haha. This thing has bascially zero documentation and I'm not exactly an expert in upnp.

[zimbatm]

@jgillich Looking at Gentoo again, it seems like it's touching iptables so probably needs root access. Their init script also runs a /etc/miniupnpd/iptables_removeall.sh script on stop which might apply for us as well ? See https://gitweb.gentoo.org/repo/gentoo.git/tree/net-misc/miniupnpd/files/miniupnpd-init.d

[zimbatm]

ArchLinux seem to be doing the same: https://projects.archlinux.org/svntogit/community.git/tree/trunk/miniupnpd.systemd?h=packages/miniupnpd

[jgillich]

They also call a script to create the rules before starting the service, I'm currently doing that via firewall.extraCommands. That could probably be integrated into the service, I'll also try running it as non-root.

[zimbatm]

Yeah, I wonder how it interacts with the NixOS built-in firewall, are the rules not going to overlap ?

[jgillich]

By "they" I meant Arch and Gentoo. :) miniupnpd only uses the chains set via upnp_forward_chain and upnp_nat_chain in the config and doesn't touch the firewall.

[zimbatm]

👍