blob: 71e1c183b2d85b8ffaf36d401abeef02569c1e15 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
{
lib,
config,
pkgs,
...
}:
let
cfg = config.services.jitterentropy-rngd;
in
{
options.services.jitterentropy-rngd = {
enable = lib.mkEnableOption "jitterentropy-rngd service configuration";
package = lib.mkPackageOption pkgs "jitterentropy-rngd" { };
osr = lib.mkOption {
type = lib.types.ints.between 3 20;
default = 3;
description = "Oversampling rate for jitterentropy (3 to 20)";
};
flags = lib.mkOption {
type = lib.types.int;
default = 0;
description = "Additional flags to pass to jitterentropy";
};
forceSP800-90B = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Force SP800-90B mode for entropy reading";
};
memlockLimit = lib.mkOption {
type = lib.types.str;
default = "2M";
description = "Set limit for lockable memory with mlock";
};
verbose = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable verbose log messages";
};
};
config =
let
# use identical arguments for status and service execution,
# in order to get meaningful output
args =
"--osr ${builtins.toString cfg.osr} --flags ${builtins.toString cfg.flags}"
+ lib.optionalString cfg.forceSP800-90B " --sp800-90b"
+ lib.optionalString cfg.verbose " -vvv";
in
lib.mkIf cfg.enable {
systemd.packages = [ cfg.package ];
systemd.services."jitterentropy".wantedBy = [ "basic.target" ];
systemd.services."jitterentropy".serviceConfig = {
# logs used configuration for comparison
ExecStartPre = [
"-${cfg.package}/bin/jitterentropy-rngd --status ${args}"
];
ExecStart = [
# clear old setting from built-in service file
""
# use service from package with our configured args
"${cfg.package}/bin/jitterentropy-rngd ${args}"
];
LimitMEMLOCK = [
# clear old setting from built-in service file
""
# use service from package with our configured limit
"${cfg.memlockLimit}"
];
};
};
meta.maintainers = with lib.maintainers; [ thillux ];
}
|
