1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
|
{
config,
pkgs,
lib,
...
}:
let
inherit (lib)
mkIf
mkEnableOption
mkPackageOption
mkOption
literalExpression
hasAttr
toList
length
head
tail
concatStringsSep
optionalString
optionalAttrs
isDerivation
recursiveUpdate
getExe
types
maintainers
makeBinPath
;
cfg = config.services.wivrn;
configFormat = pkgs.formats.json { };
# For the application option to work with systemd PATH, we find the store binary path of
# the package, concat all of the following strings, and then update the application attribute.
# Since the json config attribute type "configFormat.type" doesn't allow specifying types for
# individual attributes, we have to type check manually.
# The application option should be a list with package as the first element, though a single package is also valid.
# Note that this module depends on the package containing the meta.mainProgram attribute.
# Check if an application is provided
applicationAttrExists = hasAttr "application" cfg.config.json;
applicationList = toList cfg.config.json.application;
applicationListNotEmpty = length applicationList != 0;
applicationCheck = applicationAttrExists && applicationListNotEmpty;
# Manage packages and their exe paths
applicationAttr = head applicationList;
applicationPackage = mkIf applicationCheck applicationAttr;
applicationPackageExe = getExe applicationAttr;
serverPackageExe = (
if cfg.highPriority then "${config.security.wrapperDir}/wivrn-server" else getExe cfg.package
);
# Manage strings
applicationStrings = tail applicationList;
applicationConcat = concatStringsSep " " ([ applicationPackageExe ] ++ applicationStrings);
# Manage config file
applicationUpdate = recursiveUpdate cfg.config.json (
optionalAttrs applicationCheck { application = applicationConcat; }
);
configFile = configFormat.generate "config.json" applicationUpdate;
enabledConfig = optionalString cfg.config.enable "-f ${configFile}";
# Manage server executables and flags
serverCmdline = concatStringsSep " " (
[
serverPackageExe
enabledConfig
]
++ cfg.extraServerFlags
);
serverExec =
if cfg.steam.enable then
lib.getExe (
pkgs.writeShellScriptBin "start-wivrn-server" ''
# The server needs Steam in PATH to open Steam games from the application launcher
export PATH="${makeBinPath [ cfg.steam.package ]}:$PATH"
exec -a wivrn-server ${serverCmdline}
''
)
else
serverCmdline;
in
{
imports = [
(lib.mkRemovedOptionModule [ "services" "wivrn" "defaultRuntime" ] ''
WiVRn now manages the active runtime itself, so this option has been removed.
'')
];
options = {
services.wivrn = {
enable = mkEnableOption "WiVRn, an OpenXR streaming application";
package = mkPackageOption pkgs "wivrn" { };
openFirewall = mkEnableOption "the default ports in the firewall for the WiVRn server";
autoStart = mkEnableOption "starting the service by default";
highPriority = mkEnableOption "high priority capability for asynchronous reprojection";
monadoEnvironment = mkOption {
type = types.attrs;
description = "Environment variables to be passed to the Monado environment.";
default = { };
};
extraServerFlags = mkOption {
type = types.listOf types.str;
description = "Flags to add to the wivrn service.";
default = [ ];
example = literalExpression ''[ "--no-publish-service" ]'';
};
steam = {
enable = lib.mkEnableOption "Steam support" // {
default = true;
};
importOXRRuntimes = mkEnableOption ''
Sets `PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES` system-wide to allow Steam to automatically discover the WiVRn server.
Note that you may have to logout for this variable to be visible
'';
package = mkPackageOption pkgs "steam" { };
};
config = {
enable = mkEnableOption "configuration for WiVRn";
json = mkOption {
type = configFormat.type;
description = ''
Configuration for WiVRn. The attributes are serialized to JSON in config.json. The server will fallback to default values for any missing attributes.
Like upstream, the application option is a list including the application and it's flags. In the case of the NixOS module however, the first element of the list must be a package. The module will assert otherwise.
The application can be set to a single package because it gets passed to lib.toList, though this will not allow for flags to be passed.
WiVRn has good default configurations and most options can be configured at runtime so it is recommended to leave this empty and try the defaults before attempting manual configuration.
See <https://github.com/WiVRn/WiVRn/blob/master/docs/configuration.md>
'';
default = { };
example = literalExpression ''
{
# left eye, hardware; right eye, software; transparency, hardware
encoder = [
{
encoder = "vulkan";
codec = "h265";
}
{
encoder = "x264";
codec = "h264";
}
{
encoder = "vulkan";
codec = "h265";
}
];
application = [ pkgs.wayvr ];
}
'';
};
};
};
};
config = mkIf cfg.enable {
assertions = [
{
assertion = !applicationCheck || isDerivation applicationAttr;
message = "The application in WiVRn configuration is not a package. Please ensure that the application is a package or that a package is the first element in the list.";
}
];
security.wrappers."wivrn-server" = mkIf cfg.highPriority {
setuid = false;
owner = "root";
group = "root";
capabilities = "cap_sys_nice+eip";
source = getExe cfg.package;
};
systemd.user = {
services = {
wivrn = {
description = "WiVRn XR runtime service";
environment = recursiveUpdate {
PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES = mkIf cfg.steam.importOXRRuntimes "1";
} cfg.monadoEnvironment;
# WiVRn scans for .desktop files in $XDG_DATA_DIRS for the application launcher,
# which will execute the command in Exec when selected in the headset. If the
# Exec path isn't absolute, it will be resolved relative to $PATH, so we must
# not override the value of $PATH.
enableDefaultPath = false;
unitConfig.ConditionUser = "!@system";
serviceConfig = (
if cfg.highPriority then
{
ExecStart = serverExec;
}
# Hardening options break high-priority
else
{
ExecStart = serverExec;
# Hardening options
CapabilityBoundingSet = [ "CAP_SYS_NICE" ];
AmbientCapabilities = [ "CAP_SYS_NICE" ];
LockPersonality = true;
NoNewPrivileges = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictNamespaces = true;
RestrictSUIDSGID = true;
}
);
wantedBy = mkIf cfg.autoStart [ "default.target" ];
restartTriggers = [
cfg.package
]
++ lib.optionals cfg.steam.enable [ cfg.steam.package ];
};
};
};
services = {
avahi = {
enable = true;
publish = {
enable = true;
userServices = true;
};
};
};
networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ 9757 ];
allowedUDPPorts = [ 9757 ];
};
services.firewalld.packages = [ cfg.package ];
environment = {
systemPackages = [
cfg.package
applicationPackage
];
sessionVariables = mkIf cfg.steam.importOXRRuntimes {
PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES = "1";
};
pathsToLink = [ "/share/openxr" ];
};
};
meta.maintainers = with maintainers; [ passivelemon ];
}
|
