nix-bitcoin/modules/operator.nix

59 lines
1.7 KiB
Nix
Raw Permalink Normal View History

{ config, lib, pkgs, ... }:
2020-09-28 04:09:03 -07:00
with lib;
let
options.nix-bitcoin.operator = {
2022-07-14 14:45:26 -07:00
enable = mkOption {
type = types.bool;
default = false;
description = ''
Whether to define a user named `operator` for convenient interactive access
to nix-bitcoin features (like `bitcoin-cli`).
When using nix-bitcoin as part of a larger system config, it makes sense
to set your main system user as the operator, by setting option
`nix-bitcoin.operator.name = "MAIN_USER_NAME";`.
2022-07-14 14:45:26 -07:00
'';
};
2020-09-28 04:09:03 -07:00
name = mkOption {
type = types.str;
default = "operator";
2022-07-14 14:45:26 -07:00
description = "Name of the operator user.";
2020-09-28 04:09:03 -07:00
};
groups = mkOption {
type = with types; listOf str;
default = [];
2022-07-14 14:45:26 -07:00
description = "Extra groups of the operatur user.";
2020-09-28 04:09:03 -07:00
};
allowRunAsUsers = mkOption {
2020-09-28 04:09:03 -07:00
type = with types; listOf str;
default = [];
description = "Users as which the operator is allowed to run commands.";
};
};
cfg = config.nix-bitcoin.operator;
in {
inherit options;
2020-09-28 04:09:03 -07:00
config = mkIf cfg.enable {
users.users.${cfg.name} = {
isNormalUser = true;
extraGroups = [
"systemd-journal"
"proc" # Enable full /proc access and systemd-status
] ++ cfg.groups;
};
security = mkIf (cfg.allowRunAsUsers != []) {
# Use doas instead of sudo if enabled
doas.extraConfig = mkIf config.security.doas.enable ''
${lib.concatMapStrings (user: "permit nopass ${cfg.name} as ${user}\n") cfg.allowRunAsUsers}
'';
sudo.extraConfig = mkIf (!config.security.doas.enable) ''
${cfg.name} ALL=(${builtins.concatStringsSep "," cfg.allowRunAsUsers}) NOPASSWD: ALL
'';
};
2020-09-28 04:09:03 -07:00
};
}