colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #46361 from primeos/nixos-sks

Browse Source 
nixos/sks: Minor improvements
This commit is contained in:
Michael Weiss 2018-09-08 14:16:55 +02:00 committed by GitHub
commit 28a46c2c6f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
nixos/modules/services/security/sks.nix
View File

@ -3,44 +3,55 @@
with lib; with lib;
let let
cfg = config.services.sks; cfg = config.services.sks;
sksPkg = cfg.package; sksPkg = cfg.package;
in in {
meta.maintainers = with maintainers; [ primeos calbrecht jcumming ];
{
options = { options = {
services.sks = { services.sks = {
enable = mkEnableOption "sks"; enable = mkEnableOption ''
SKS (synchronizing key server for OpenPGP) and start the database
server. You need to create "''${dataDir}/dump/*.gpg" for the initial
import'';
package = mkOption { package = mkOption {
default = pkgs.sks; default = pkgs.sks;
defaultText = "pkgs.sks"; defaultText = "pkgs.sks";
type = types.package; type = types.package;
description = " description = "Which SKS derivation to use.";
Which sks derivation to use. };
";
dataDir = mkOption {
type = types.path;
default = "/var/db/sks";
example = "/var/lib/sks";
# TODO: The default might change to "/var/lib/sks" as this is more
# common. There's also https://github.com/NixOS/nixpkgs/issues/26256
# and "/var/db" is not FHS compliant (seems to come from BSD).
description = ''
Data directory (-basedir) for SKS, where the database and all
configuration files are located (e.g. KDB, PTree, membership and
sksconf).
'';
}; };
hkpAddress = mkOption { hkpAddress = mkOption {
default = [ "127.0.0.1" "::1" ]; default = [ "127.0.0.1" "::1" ];
type = types.listOf types.str; type = types.listOf types.str;
description = " description = ''
Wich ip addresses the sks-keyserver is listening on. Domain names, IPv4 and/or IPv6 addresses to listen on for HKP
"; requests.
'';
}; };
hkpPort = mkOption { hkpPort = mkOption {
default = 11371; default = 11371;
type = types.int; type = types.ints.u16;
description = " description = "HKP port to listen on.";
Which port the sks-keyserver is listening on.
";
}; };
}; };
}; };
@ -51,7 +62,7 @@ in
users.users.sks = { users.users.sks = {
createHome = true; createHome = true;
home = "/var/db/sks"; home = cfg.dataDir;
isSystemUser = true; isSystemUser = true;
shell = "${pkgs.coreutils}/bin/true"; shell = "${pkgs.coreutils}/bin/true";
}; };
@ -62,19 +73,21 @@ in
home = config.users.users.sks.home; home = config.users.users.sks.home;
user = config.users.users.sks.name; user = config.users.users.sks.name;
in { in {
sks-keyserver = { "sks-db" = {
description = "SKS database server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
preStart = '' preStart = ''
mkdir -p ${home}/dump mkdir -p ${home}/dump
${pkgs.sks}/bin/sks build ${home}/dump/*.gpg -n 10 -cache 100 || true #*/ ${sksPkg}/bin/sks build ${home}/dump/*.gpg -n 10 -cache 100 || true #*/
${pkgs.sks}/bin/sks cleandb || true ${sksPkg}/bin/sks cleandb || true
${pkgs.sks}/bin/sks pbuild -cache 20 -ptree_cache 70 || true ${sksPkg}/bin/sks pbuild -cache 20 -ptree_cache 70 || true
''; '';
serviceConfig = { serviceConfig = {
WorkingDirectory = home; WorkingDirectory = home;
User = user; User = user;
Restart = "always"; Restart = "always";
ExecStart = "${pkgs.sks}/bin/sks db -hkp_address ${hkpAddress} -hkp_port ${hkpPort}"; ExecStart = "${sksPkg}/bin/sks db -hkp_address ${hkpAddress} -hkp_port ${hkpPort}";
}; };
}; };
}; };