blob: 13a30d8ad5652ecde5d57b72bb6ab948738b2393 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.framework-control;
in
{
meta.maintainers = [ lib.maintainers.ozturkkl ];
options.services.framework-control = {
enable = lib.mkEnableOption "Framework Control device hardware service";
package = lib.mkPackageOption pkgs "framework-control" { };
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ cfg.package ];
systemd.services.framework-control = {
description = "Framework Control Service";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
# framework-control shells out to framework_tool at runtime for hardware access
path = [ pkgs.framework-tool ];
serviceConfig = {
Type = "simple";
ExecStart = lib.getExe cfg.package;
Restart = "on-failure";
RestartSec = "5s";
NoNewPrivileges = true;
PrivateTmp = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
LockPersonality = true;
RestrictRealtime = true;
RestrictNamespaces = true;
SystemCallArchitectures = "native";
};
};
};
}
|
