colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #274307 from thillux/esdm-1.0.1

Browse Source 
esdm: update module after 1.0.1 changes
This commit is contained in:
WilliButz 2024-03-11 15:11:05 +01:00 committed by GitHub
commit a2c0efbf5e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 26 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
nixos/modules/services/security/esdm.nix
View File

@ -4,49 +4,33 @@ let
cfg = config.services.esdm;
in
{
imports = [
# removed option 'services.esdm.cuseRandomEnable'
(lib.mkRemovedOptionModule [ "services" "esdm" "cuseRandomEnable" ] ''
Use services.esdm.enableLinuxCompatServices instead.
'')
# removed option 'services.esdm.cuseUrandomEnable'
(lib.mkRemovedOptionModule [ "services" "esdm" "cuseUrandomEnable" ] ''
Use services.esdm.enableLinuxCompatServices instead.
'')
# removed option 'services.esdm.procEnable'
(lib.mkRemovedOptionModule [ "services" "esdm" "procEnable" ] ''
Use services.esdm.enableLinuxCompatServices instead.
'')
# removed option 'services.esdm.verbose'
(lib.mkRemovedOptionModule [ "services" "esdm" "verbose" ] ''
There is no replacement.
'')
];
options.services.esdm = {
enable = lib.mkEnableOption (lib.mdDoc "ESDM service configuration");
package = lib.mkPackageOption pkgs "esdm" { };
serverEnable = lib.mkOption {
enableLinuxCompatServices = lib.mkOption {
type = lib.types.bool;
default = true;
description = lib.mdDoc ''
Enable option for ESDM server service. If serverEnable == false, then the esdm-server
will not start. Also the subsequent services esdm-cuse-random, esdm-cuse-urandom
and esdm-proc will not start as these have the entry Want=esdm-server.service.
'';
};
cuseRandomEnable = lib.mkOption {
type = lib.types.bool;
default = true;
description = lib.mdDoc ''
Enable option for ESDM cuse-random service. Determines if the esdm-cuse-random.service
is started.
'';
};
cuseUrandomEnable = lib.mkOption {
type = lib.types.bool;
default = true;
description = lib.mdDoc ''
Enable option for ESDM cuse-urandom service. Determines if the esdm-cuse-urandom.service
is started.
'';
};
procEnable = lib.mkOption {
type = lib.types.bool;
default = true;
description = lib.mdDoc ''
Enable option for ESDM proc service. Determines if the esdm-proc.service
is started.
'';
};
verbose = lib.mkOption {
type = lib.types.bool;
default = false;
description = lib.mdDoc ''
Enable verbose ExecStart for ESDM. If verbose == true, then the corresponding "ExecStart"
values of the 4 aforementioned services are overwritten with the option
for the highest verbosity.
Enable /dev/random, /dev/urandom and /proc/sys/kernel/random/* userspace wrapper.
'';
};
};
@ -55,46 +39,13 @@ in
lib.mkMerge [
({
systemd.packages = [ cfg.package ];
systemd.services."esdm-server".wantedBy = [ "basic.target" ];
})
# It is necessary to set those options for these services to be started by systemd in NixOS
(lib.mkIf cfg.serverEnable {
systemd.services."esdm-server".wantedBy = [ "basic.target" ];
systemd.services."esdm-server".serviceConfig = lib.mkIf cfg.verbose {
ExecStart = [
" " # unset previous value defined in 'esdm-server.service'
"${cfg.package}/bin/esdm-server -f -vvvvvv"
];
};
})
(lib.mkIf cfg.cuseRandomEnable {
systemd.services."esdm-cuse-random".wantedBy = [ "basic.target" ];
systemd.services."esdm-cuse-random".serviceConfig = lib.mkIf cfg.verbose {
ExecStart = [
" " # unset previous value defined in 'esdm-cuse-random.service'
"${cfg.package}/bin/esdm-cuse-random -f -v 6"
];
};
})
(lib.mkIf cfg.cuseUrandomEnable {
systemd.services."esdm-cuse-urandom".wantedBy = [ "basic.target" ];
systemd.services."esdm-cuse-urandom".serviceConfig = lib.mkIf cfg.verbose {
ExecStart = [
" " # unset previous value defined in 'esdm-cuse-urandom.service'
"${config.services.esdm.package}/bin/esdm-cuse-urandom -f -v 6"
];
};
})
(lib.mkIf cfg.procEnable {
systemd.services."esdm-proc".wantedBy = [ "basic.target" ];
systemd.services."esdm-proc".serviceConfig = lib.mkIf cfg.verbose {
ExecStart = [
" " # unset previous value defined in 'esdm-proc.service'
"${cfg.package}/bin/esdm-proc --relabel -f -o allow_other /proc/sys/kernel/random -v 6"
];
};
(lib.mkIf cfg.enableLinuxCompatServices {
systemd.targets."esdm-linux-compat".wantedBy = [ "basic.target" ];
systemd.services."esdm-server-suspend".wantedBy = [ "sleep.target" "suspend.target" "hibernate.target" ];
systemd.services."esdm-server-resume".wantedBy = [ "sleep.target" "suspend.target" "hibernate.target" ];
})
]);