27c45b82cc
This greatly improves readability and makes it easier to discover options.
This commit was genereated by running the following script inside the
repo root dir:
#!/usr/bin/env ruby
def transform(src)
return false if src.include?('inherit options;')
success = false
options = nil
src.sub!(/^ options.*?^ }.*?;/m) do |match|
options = match
" inherit options;"
end
return false if !options
src.sub!(/^with lib;\s*let\n+/m) do |match|
success = true
<<~EOF
with lib;
let
#{options}
EOF
end
success
end
Dir['modules/**/*.nix'].each do |f|
src = File.read(f)
if transform(src)
puts "Changed file #{f}"
File.write(f, src)
end
end
53 lines
1.5 KiB
Nix
53 lines
1.5 KiB
Nix
# Define an operator user for convenient interactive access to nix-bitcoin
|
|
# features and services.
|
|
#
|
|
# When using nix-bitcoin as part of a larger system config, set
|
|
# `nix-bitcoin.operator.name` to your main user name.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
options.nix-bitcoin.operator = {
|
|
enable = mkEnableOption "operator user";
|
|
name = mkOption {
|
|
type = types.str;
|
|
default = "operator";
|
|
description = "User name.";
|
|
};
|
|
groups = mkOption {
|
|
type = with types; listOf str;
|
|
default = [];
|
|
description = "Extra groups.";
|
|
};
|
|
allowRunAsUsers = mkOption {
|
|
type = with types; listOf str;
|
|
default = [];
|
|
description = "Users as which the operator is allowed to run commands.";
|
|
};
|
|
};
|
|
|
|
cfg = config.nix-bitcoin.operator;
|
|
in {
|
|
inherit options;
|
|
|
|
config = mkIf cfg.enable {
|
|
users.users.${cfg.name} = {
|
|
isNormalUser = true;
|
|
extraGroups = [
|
|
"systemd-journal"
|
|
"proc" # Enable full /proc access and systemd-status
|
|
] ++ cfg.groups;
|
|
};
|
|
|
|
security = mkIf (cfg.allowRunAsUsers != []) {
|
|
# Use doas instead of sudo if enabled
|
|
doas.extraConfig = mkIf config.security.doas.enable ''
|
|
${lib.concatMapStrings (user: "permit nopass ${cfg.name} as ${user}\n") cfg.allowRunAsUsers}
|
|
'';
|
|
sudo.extraConfig = mkIf (!config.security.doas.enable) ''
|
|
${cfg.name} ALL=(${builtins.concatStringsSep "," cfg.allowRunAsUsers}) NOPASSWD: ALL
|
|
'';
|
|
};
|
|
};
|
|
}
|