b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #231108 from corngood/gpg-agent

Browse source 
nixos/gnupg: add systemd configuration
This commit is contained in:
Michele Guerini Rocco 2023-06-26 16:22:41 +02:00 committed by GitHub
parent 089fbf534b 8ea644997f
commit 547cd96f10
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 80 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

82
nixos/modules/programs/gnupg.nix
View file

@ -94,38 +94,110 @@ in
};
config = mkIf cfg.agent.enable {
environment.etc."gnupg/gpg-agent.conf".text = ''
pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
'';
# This overrides the systemd user unit shipped with the gnupg package
systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
serviceConfig.ExecStart = [ "" ''
${cfg.package}/bin/gpg-agent --supervised \
--pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
'' ];
unitConfig = {
Description = "GnuPG cryptographic agent and passphrase cache";
Documentation = "man:gpg-agent(1)";
Requires = [ "gpg-agent.socket" ];
};
serviceConfig = {
ExecStart = "${cfg.package}/bin/gpg-agent --supervised";
ExecReload = "${cfg.package}/bin/gpgconf --reload gpg-agent";
};
};
systemd.user.sockets.gpg-agent = {
unitConfig = {
Description = "GnuPG cryptographic agent and passphrase cache";
Documentation = "man:gpg-agent(1)";
};
socketConfig = {
ListenStream = "%t/gnupg/S.gpg-agent";
FileDescriptorName = "std";
SocketMode = "0600";
DirectoryMode = "0700";
};
wantedBy = [ "sockets.target" ];
};
systemd.user.sockets.gpg-agent-ssh = mkIf cfg.agent.enableSSHSupport {
unitConfig = {
Description = "GnuPG cryptographic agent (ssh-agent emulation)";
Documentation = "man:gpg-agent(1) man:ssh-add(1) man:ssh-agent(1) man:ssh(1)";
};
socketConfig = {
ListenStream = "%t/gnupg/S.gpg-agent.ssh";
FileDescriptorName = "ssh";
Service = "gpg-agent.service";
SocketMode = "0600";
DirectoryMode = "0700";
};
wantedBy = [ "sockets.target" ];
};
systemd.user.sockets.gpg-agent-extra = mkIf cfg.agent.enableExtraSocket {
unitConfig = {
Description = "GnuPG cryptographic agent and passphrase cache (restricted)";
Documentation = "man:gpg-agent(1)";
};
socketConfig = {
ListenStream = "%t/gnupg/S.gpg-agent.extra";
FileDescriptorName = "extra";
Service = "gpg-agent.service";
SocketMode = "0600";
DirectoryMode = "0700";
};
wantedBy = [ "sockets.target" ];
};
systemd.user.sockets.gpg-agent-browser = mkIf cfg.agent.enableBrowserSocket {
unitConfig = {
Description = "GnuPG cryptographic agent and passphrase cache (access for web browsers)";
Documentation = "man:gpg-agent(1)";
};
socketConfig = {
ListenStream = "%t/gnupg/S.gpg-agent.browser";
FileDescriptorName = "browser";
Service = "gpg-agent.service";
SocketMode = "0600";
DirectoryMode = "0700";
};
wantedBy = [ "sockets.target" ];
};
systemd.user.services.dirmngr = mkIf cfg.dirmngr.enable {
unitConfig = {
Description = "GnuPG network certificate management daemon";
Documentation = "man:dirmngr(8)";
Requires = "dirmngr.socket";
};
serviceConfig = {
ExecStart = "${cfg.package}/bin/dirmngr --supervised";
ExecReload = "${cfg.package}/bin/gpgconf --reload dirmngr";
};
};
systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
unitConfig = {
Description = "GnuPG network certificate management daemon";
Documentation = "man:dirmngr(8)";
};
socketConfig = {
ListenStream = "%t/gnupg/S.dirmngr";
SocketMode = "0600";
DirectoryMode = "0700";
};
wantedBy = [ "sockets.target" ];
};
services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
environment.systemPackages = with pkgs; [ cfg.package ];
systemd.packages = [ cfg.package ];
environment.interactiveShellInit = ''
# Bind gpg-agent to this TTY if gpg commands are used.

2
pkgs/tools/security/gnupg/22.nix
View file

@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
passthru.tests.connman = lib.nixosTests.gnupg;
passthru.tests = lib.nixosTests.gnupg;
meta = with lib; {
homepage = "https://gnupg.org";

3
pkgs/tools/security/gnupg/24.nix
View file

@ -6,6 +6,7 @@
, withPcsc ? !enableMinimal, pcsclite
, guiSupport ? stdenv.isDarwin, pinentry
, withTpm2Tss ? !stdenv.isDarwin && !enableMinimal, tpm2-tss
, nixosTests
}:
assert guiSupport -> enableMinimal == false;
@ -85,7 +86,7 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
passthru.tests.connman = lib.nixosTests.gnupg;
passthru.tests = nixosTests.gnupg;
meta = with lib; {
homepage = "https://gnupg.org";