nixos/murmur: support setting custom stateDir, user and group

[DCsunset]

This PR supports setting custom state directory, user and group for the Murmur service:

• The custom state directory is helpful when you want to manage the state in a different place for backup or sync.
• The user and group options allow the service to run as existing users so that permissions can be managed more easily

The stateDir, user, and group options are common in other modules as well. It should be easy for users to use and bring no breaking changes.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[felixsinger]

<policy user="murmur">
            <allow own="net.sourceforge.mumble.murmur"/>
</policy>

Policy user needs to be changed as well.

[felixsinger]

environmentFile = mkOption {
        type = types.nullOr types.path;
        default = null;
        example = "/var/lib/murmur/murmurd.env";
        ...
};

Make use of cfg.stateDir in the example.

Looks good otherwise.

[felixsinger]

@GrahamcOfBorg test mumble

[felixsinger]

For some reason apparmor gets triggered because of denied accesses, but I can't see why.

@thoughtpolice Since you are listed as the maintainer of the Mumble tests can you help here?

[tnias]

With the trailing slash there are no more DENIED messages in the nixosTests.mumble's log.

diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index ef1dcde16748..3d8a5ca96298 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -414,7 +414,7 @@ in
         r ${config.environment.etc."lsb-release".source},
         owner rwk ${cfg.stateDir}/murmur.sqlite,
         owner rw ${cfg.stateDir}/murmur.sqlite-journal,
-        owner r ${cfg.stateDir},
+        owner r ${cfg.stateDir}/,
         r /run/murmur/murmurd.pid,
         r /run/murmur/murmurd.ini,
         r ${configFile},

[DCsunset]

Sorry to have overlooked the trailing slash. I've added it in this PR.

[felixsinger]

@GrahamcOfBorg test mumble