grimm-nixos-laptop/common/tooling/security.nix

56 lines
1.3 KiB
Nix
Raw Normal View History

2024-05-07 23:31:41 +02:00
{
pkgs,
config,
lib,
...
}:
2024-04-13 19:16:33 +02:00
let
cfg = config.grimmShared;
in
{
2024-05-07 23:31:41 +02:00
config =
with cfg;
lib.mkIf enable {
security.polkit.enable = true;
networking.firewall.enable = lib.mkIf network true;
security.rtkit.enable = true;
2024-04-13 19:16:33 +02:00
2024-05-07 23:31:41 +02:00
security.doas.enable = true;
security.sudo.enable = false;
security.doas.extraRules = [
{
users = lib.attrNames (lib.filterAttrs (n: v: v.isNormalUser) config.users.users);
keepEnv = true;
persist = true;
}
];
2024-04-13 19:16:33 +02:00
2024-05-07 23:31:41 +02:00
environment.systemPackages =
with pkgs;
[
mkpasswd
gnupg
libsecret
vulnix
doas-sudo-shim # muscle memory
agenix
]
++ lib.optionals (tooling.enable && tooling.pass) [
pass
(writeShellScriptBin "passw" "pass $@")
]
++ lib.optional graphical lxqt.lxqt-policykit;
2024-04-13 19:16:33 +02:00
2024-05-07 23:31:41 +02:00
services.passSecretService.enable = lib.mkIf (tooling.enable && tooling.pass) true;
programs.gnupg.agent = {
settings = {
# default-cache-ttl = 6000;
};
pinentryPackage = with pkgs; lib.mkForce (if graphical then pinentry-qt else pinentry-tty);
enable = true;
2024-04-13 19:16:33 +02:00
};
};
options.grimmShared.tooling.pass = lib.mkEnableOption "Enables password-store, gnupg and such secret handling";
2024-04-13 19:16:33 +02:00
}