colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

networkmanager/modemmanager: get closer to nixpkgs upstream

Browse Source 
i've seen enough, that there's a path toward getting nixos proper to sandbox this in a way i'm happy with -- in time
This commit is contained in:
Colin 2024-06-02 06:49:25 +00:00
parent f5e5d1bcc4
commit 1b85aa0441
4 changed files with 134 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
hosts/common/programs/modemmanager.nix
View File

@ -50,32 +50,41 @@ in
];
};
networking.modemmanager = {
enable = cfg.enabled;
package = cfg.package;
};
systemd.services.ModemManager = lib.mkIf cfg.enabled {
aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
after = [ "polkit.service" ];
requires = [ "polkit.service" ];
wantedBy = [ "network.target" ];
# aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
# after = [ "polkit.service" ];
# requires = [ "polkit.service" ];
# wantedBy = [ "network.target" ];
path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
serviceConfig.Type = "dbus";
serviceConfig.BusName = "org.freedesktop.ModemManager1";
# serviceConfig.Type = "dbus";
# serviceConfig.BusName = "org.freedesktop.ModemManager1";
# only if started with `--debug` does mmcli let us issue AT commands like
# `mmcli --modem any --command=<AT_CMD>`
serviceConfig.ExecStart = "${lib.getExe cfg.package} --debug";
serviceConfig.ExecStart = [
"" # first blank line is to clear the upstream `ExecStart` field.
"${lib.getExe cfg.package} --debug"
];
# --debug sets DEBUG level logging: so reset
serviceConfig.ExecStartPost = "${lib.getExe config.sane.programs.mmcli.package} --set-logging=INFO";
serviceConfig.Restart = "on-abort";
serviceConfig.StandardError = "null";
serviceConfig.CapabilityBoundingSet = "CAP_SYS_ADMIN CAP_NET_ADMIN";
serviceConfig.ProtectSystem = true;
serviceConfig.ProtectHome = true;
serviceConfig.PrivateTmp = true;
serviceConfig.RestrictAddressFamilies = "AF_NETLINK AF_UNIX AF_QIPCRTR";
serviceConfig.NoNewPrivileges = true;
# v this is what upstream ships
# serviceConfig.Restart = "on-abort";
# serviceConfig.StandardError = "null";
# serviceConfig.CapabilityBoundingSet = "CAP_SYS_ADMIN CAP_NET_ADMIN";
# serviceConfig.ProtectSystem = true;
# serviceConfig.ProtectHome = true;
# serviceConfig.PrivateTmp = true;
# serviceConfig.RestrictAddressFamilies = "AF_NETLINK AF_UNIX AF_QIPCRTR";
# serviceConfig.NoNewPrivileges = true;
};
# so that ModemManager can discover when the modem appears
services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
# services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
}

171
hosts/common/programs/networkmanager.nix
View File

@ -78,14 +78,17 @@ in
(lib.mkIf cfg.enabled {
# add to systemd.packages so we get the service file it ships, then override what we need to customize (taken from nixpkgs)
systemd.packages = [ cfg.package ];
# systemd.packages = [ cfg.package ];
networking.networkmanager.enable = true;
networking.networkmanager.enableDefaultPlugins = false;
networking.networkmanager.package = cfg.package;
systemd.services.NetworkManager = {
wantedBy = [ "network.target" ];
# wantedBy = [ "network.target" ];
aliases = [ "dbus-org.freedesktop.NetworkManager.service" ];
path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
serviceConfig.RuntimeDirectory = "NetworkManager"; #< tells systemd to create /run/NetworkManager
serviceConfig.StateDirectory = "NetworkManager"; #< tells systemd to create /var/lib/NetworkManager
# serviceConfig.StateDirectory = "NetworkManager"; #< tells systemd to create /var/lib/NetworkManager
serviceConfig.User = "networkmanager";
serviceConfig.Group = "networkmanager";
serviceConfig.AmbientCapabilities = [
@ -101,13 +104,13 @@ in
systemd.services.NetworkManager-wait-online = {
path = [ "/run/current-system/sw" ]; #< so `nm-online` can find `sanebox`
wantedBy = [ "network-online.target" ];
# wantedBy = [ "network-online.target" ];
serviceConfig.User = "networkmanager";
serviceConfig.Group = "networkmanager";
};
systemd.services.NetworkManager-dispatcher = {
wantedBy = [ "NetworkManager.service" ];
# wantedBy = [ "NetworkManager.service" ];
after = [ "trust-dns-localhost.service" ]; #< so that /var/lib/trust-dns will exist
path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
# to debug, add NM_DISPATCHER_DEBUG_LOG=1
@ -121,88 +124,106 @@ in
serviceConfig.Group = "networkmanager";
};
environment.etc = {
"NetworkManager/system-connections".source = "/var/lib/NetworkManager/system-connections";
"NetworkManager/NetworkManager.conf".text = ''
[device]
# wifi.backend: wpa_supplicant or iwd
wifi.backend=wpa_supplicant
wifi.scan-rand-mac-address=true
networking.networkmanager.settings = {
# wifi.backend = "wpa_supplicant";
# wifi.scan-rand-mac-address = true;
[logging]
audit=false
# level: TRACE, DEBUG, INFO, WARN, ERR, OFF
level=INFO
# domain=...
# logging.audit = false;
logging.level = "INFO";
[main]
# dhcp:
# - `internal` (default)
# - `dhclient` (requires dhclient to be installed)
# - `dhcpcd` (requires dhcpcd to be installed)
dhcp=internal
# dns:
# - `default`: update /etc/resolv.conf with nameservers provided by the active connection
# - `none`: NM won't update /etc/resolv.conf
# - `systemd-resolved`: push DNS config to systemd-resolved
# - `dnsmasq`: run a local caching nameserver
dns=${if config.services.resolved.enable then
"systemd-resolved"
else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
"none"
else
"internal"
}
plugins=keyfile
# rc-manager: how NM should write to /etc/resolv.conf
# - regardless of this setting, NM will write /var/lib/NetworkManager/resolv.conf
rc-manager=unmanaged
# systemd-resolved: send DNS config to systemd-resolved?
# this setting has no effect if dns="systemd-resolved"; it's supplementary, not absolute.
systemd-resolved=false
# debug=... (see also: NM_DEBUG env var)
'';
# main.dhcp = "internal";
main.dns = if config.services.resolved.enable then
"systemd-resolved"
else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
"none"
else
"internal"
;
main.systemd-resolved = false;
};
hardware.wirelessRegulatoryDatabase = true;
networking.useDHCP = false;
services.udev.packages = [ cfg.package ];
security.polkit.enable = lib.mkDefault true;
environment.etc = {
"NetworkManager/system-connections".source = "/var/lib/NetworkManager/system-connections";
# "NetworkManager/NetworkManager.conf".text = ''
# [device]
# # wifi.backend: wpa_supplicant or iwd
# wifi.backend=wpa_supplicant
# wifi.scan-rand-mac-address=true
security.polkit.extraConfig = lib.concatStringsSep "\n" [
# allow networkmanager unbounded control over modemmanager.
# i believe this was sourced from the default nixpkgs config.
''
polkit.addRule(function(action, subject) {
if (subject.isInGroup("networkmanager")
&& (
action.id.indexOf("org.freedesktop.NetworkManager.") == 0
|| action.id.indexOf("org.freedesktop.ModemManager") == 0
)
) {
return polkit.Result.YES;
}
});
''
# allow networkmanager to control systemd-resolved,
# which it needs to do to apply new DNS settings when using systemd-resolved.
''
polkit.addRule(function(action, subject) {
if (subject.isInGroup("networkmanager") && action.id.indexOf("org.freedesktop.resolve1.") == 0) {
return polkit.Result.YES;
}
});
''
];
# [logging]
# audit=false
# # level: TRACE, DEBUG, INFO, WARN, ERR, OFF
# level=INFO
# # domain=...
users.groups.networkmanager.gid = config.ids.gids.networkmanager;
# [main]
# # dhcp:
# # - `internal` (default)
# # - `dhclient` (requires dhclient to be installed)
# # - `dhcpcd` (requires dhcpcd to be installed)
# dhcp=internal
# # dns:
# # - `default`: update /etc/resolv.conf with nameservers provided by the active connection
# # - `none`: NM won't update /etc/resolv.conf
# # - `systemd-resolved`: push DNS config to systemd-resolved
# # - `dnsmasq`: run a local caching nameserver
# dns=${if config.services.resolved.enable then
# "systemd-resolved"
# else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
# "none"
# else
# "internal"
# }
# plugins=keyfile
# # rc-manager: how NM should write to /etc/resolv.conf
# # - regardless of this setting, NM will write /var/lib/NetworkManager/resolv.conf
# rc-manager=unmanaged
# # systemd-resolved: send DNS config to systemd-resolved?
# # this setting has no effect if dns="systemd-resolved"; it's supplementary, not absolute.
# systemd-resolved=false
# # debug=... (see also: NM_DEBUG env var)
# '';
};
# hardware.wirelessRegulatoryDatabase = true;
# networking.useDHCP = false;
# services.udev.packages = [ cfg.package ];
# security.polkit.enable = lib.mkDefault true;
# security.polkit.extraConfig = lib.concatStringsSep "\n" [
# # allow networkmanager unbounded control over modemmanager.
# # i believe this was sourced from the default nixpkgs config.
# ''
# polkit.addRule(function(action, subject) {
# if (subject.isInGroup("networkmanager")
# && (
# action.id.indexOf("org.freedesktop.NetworkManager.") == 0
# || action.id.indexOf("org.freedesktop.ModemManager") == 0
# )
# ) {
# return polkit.Result.YES;
# }
# });
# ''
# allow networkmanager to control systemd-resolved,
# which it needs to do to apply new DNS settings when using systemd-resolved.
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (subject.isInGroup("networkmanager") && action.id.indexOf("org.freedesktop.resolve1.") == 0) {
return polkit.Result.YES;
}
});
'';
# users.groups.networkmanager.gid = config.ids.gids.networkmanager;
users.users.networkmanager = {
isSystemUser = true;
group = "networkmanager";
extraGroups = [ "trust-dns" ];
};
boot.kernelModules = [ "ctr" ]; #< TODO: needed (what even is this)?
# boot.kernelModules = [ "ctr" ]; #< TODO: needed (what even is this)?
# TODO: NetworkManager-ensure-profiles?
})
];

7
hosts/common/programs/wpa_supplicant.nix
View File

@ -50,8 +50,11 @@ in
};
}
(lib.mkIf cfg.enabled {
services.udev.packages = [ cfg.package ];
systemd.packages = [ cfg.package ]; #< needs to be on systemd.packages so we get its service file
#v TODO: networkmanager module enforces that it install this for us...
# if i relly want to avoid that, maybe i implement some `apply` override for `environment.systemPackages`, & others
# or switch to the `iwd` backend, which is more patchable.
# services.udev.packages = [ cfg.package ];
# systemd.packages = [ cfg.package ]; #< needs to be on systemd.packages so we get its service file
systemd.services.wpa_supplicant = {
path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
serviceConfig.User = "networkmanager";

8
nixpatches/list.nix
View File

@ -32,6 +32,14 @@ in [
# etc, where "date" is like "20240228181608"
# and can be found with `nix-repl > :lf . > lastModifiedDate`
(fetchpatch' {
title = "nixos/networkmanager: split ModemManager bits into own module";
saneCommit = "23bfba9b76757ffc00fc2be810009dcf92e2eaf2";
hash = "sha256-cn6ihwO3MyzdpVoJoQNKAHyo8GuGvFP6vr//7r9pzjE=";
# saneCommit = "a0d8a55e9da56b56ab0a7d72d46cad5dd1667c95";
# hash = "sha256-MGS1b1dC2n0FY3zizaO4lhUyuIXmVf9vBkexEo10Lr4=";
})
(fetchpatch' {
title = "trust-dns: rebrand as hickory-dns";
saneCommit = "a7613d50c58b5612a7b806ce1375d8bf0485ab55";