80 lines
2.4 KiB
Nix
80 lines
2.4 KiB
Nix
|
{ config, pkgs, ... }:
|
||
|
|
|
||
|
|
# Home Assistant endpoint that puts Nethergarde (truenas VM) and ashenvale_crypt to rest.
|
||
|
|
# HTTP API (unprivileged) -> trigger file in /run/fde-lock-api -> path unit -> root oneshot.
|
||
|
|
# Token: /etc/nixos/secrets/fde-lock-token (not versioned).
|
||
|
|
|
||
|
|
let
|
||
|
|
listen = "192.168.0.19";
|
||
|
|
port = 8742;
|
||
|
|
allowed = "192.168.0.14"; # varian (Home Assistant)
|
||
|
|
|
||
|
|
fde-lock = pkgs.writeShellApplication {
|
||
|
|
name = "fde-lock";
|
||
|
|
runtimeInputs = with pkgs; [
|
||
|
|
coreutils util-linux procps gawk gnused
|
||
|
|
lvm2 cryptsetup
|
||
|
|
config.virtualisation.incus.clientPackage
|
||
|
|
];
|
||
|
|
text = builtins.readFile ./fde-lock/lock.sh;
|
||
|
|
};
|
||
|
|
|
||
|
|
lockService = mode: {
|
||
|
|
description = "Put Nethergarde and ashenvale_crypt to rest (${mode})";
|
||
|
|
# Never (re)started by a rebuild, only by its path unit.
|
||
|
|
restartIfChanged = false;
|
||
|
|
serviceConfig = {
|
||
|
|
Type = "oneshot";
|
||
|
|
ExecStart = "${fde-lock}/bin/fde-lock ${mode}";
|
||
|
|
StandardInput = "null";
|
||
|
|
TimeoutStartSec = "6min";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
trigger = name: {
|
||
|
|
wantedBy = [ "paths.target" ];
|
||
|
|
pathConfig = {
|
||
|
|
PathChanged = "/run/fde-lock-api/${name}";
|
||
|
|
Unit = "fde-${name}.service";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
in
|
||
|
|
{
|
||
|
|
systemd.services.fde-lock = lockService "lock";
|
||
|
|
systemd.services.fde-check = lockService "check";
|
||
|
|
systemd.paths.fde-lock = trigger "lock";
|
||
|
|
systemd.paths.fde-check = trigger "check";
|
||
|
|
|
||
|
|
users.users.fde-lock-api = { isSystemUser = true; group = "fde-lock-api"; };
|
||
|
|
users.groups.fde-lock-api = { };
|
||
|
|
|
||
|
|
systemd.tmpfiles.rules = [
|
||
|
|
"d /run/fde-lock-api 0755 fde-lock-api fde-lock-api -"
|
||
|
|
"d /run/fde-lock 0755 root root -"
|
||
|
|
];
|
||
|
|
|
||
|
|
systemd.services.fde-lock-api = {
|
||
|
|
description = "HTTP trigger for fde-lock (Home Assistant)";
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
wants = [ "network-online.target" ];
|
||
|
|
after = [ "network-online.target" ];
|
||
|
|
environment = {
|
||
|
|
FDE_LOCK_LISTEN = listen;
|
||
|
|
FDE_LOCK_PORT = toString port;
|
||
|
|
FDE_LOCK_ALLOWED = allowed;
|
||
|
|
};
|
||
|
|
serviceConfig = {
|
||
|
|
ExecStart = "${pkgs.python3}/bin/python3 ${./fde-lock/api.py}";
|
||
|
|
User = "fde-lock-api";
|
||
|
|
Group = "fde-lock-api";
|
||
|
|
LoadCredential = "token:/etc/nixos/secrets/fde-lock-token";
|
||
|
|
Restart = "always";
|
||
|
|
RestartSec = 5;
|
||
|
|
NoNewPrivileges = true;
|
||
|
|
ProtectSystem = "strict";
|
||
|
|
ProtectHome = true;
|
||
|
|
PrivateTmp = true;
|
||
|
|
ReadWritePaths = [ "/run/fde-lock-api" ];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|