blob: 6fc27890ed913f1fe58ddfcc7d41c8dddcb01882 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.programs.passless;
settingsFormat = pkgs.formats.toml { };
settingsFile = settingsFormat.generate "passless.toml" cfg.settings;
in
{
options.programs.passless = {
enable = lib.mkEnableOption "passless";
package = lib.mkPackageOption pkgs "passless" { };
users = lib.options.mkOption {
type = with lib.types; listOf str;
description = ''
Users that intend to use passless and should be added to the fido group.
'';
default = [ ];
example = [ "alice" ];
};
settings = lib.mkOption {
inherit (settingsFormat) type;
default = { };
example = {
pass.store-path = "/home/alice/.local/share/password-store";
};
description = ''
Configuration included in `config.toml`.
See <https://github.com/pando85/passless#configuration-1> for documentation or run `passless config print` to see default configuration.
'';
};
};
config = lib.mkIf config.programs.passless.enable {
users.groups.fido.members = cfg.users;
boot.kernelModules = [ "uhid" ];
services.udev.extraRules = ''
KERNEL=="uhid", GROUP="fido", MODE="0660"
'';
# From https://github.com/pando85/passless/blob/master/contrib/systemd/passless.service
systemd.user.services.passless = {
description = "Passless FIDO2 Software Authenticator";
documentation = [ "https://github.com/pando85/passless" ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "default.target" ];
path = [ config.programs.gnupg.package ];
serviceConfig = {
Type = "simple";
ExecStart = "${lib.getExe cfg.package} --config-path ${settingsFile}";
Restart = "on-failure";
RestartSec = "5s";
# Security hardening
# The application already handles its own memory locking and core dump prevention
# but we can add additional systemd protections
NoNewPrivileges = true;
LimitMEMLOCK = "2M";
SyslogIdentifier = "passless";
};
};
# So users can use the `passless client` command
users.users = lib.genAttrs cfg.users (_: {
packages = [ cfg.package ];
});
};
meta.maintainers = with lib.maintainers; [ erictapen ];
}
|
