Merge pull request #231108 from corngood/gpg-agent
nixos/gnupg: add systemd configuration
This commit is contained in:
commit
547cd96f10
|
@ -94,38 +94,110 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.agent.enable {
|
config = mkIf cfg.agent.enable {
|
||||||
|
environment.etc."gnupg/gpg-agent.conf".text = ''
|
||||||
|
pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
|
||||||
|
'';
|
||||||
|
|
||||||
# This overrides the systemd user unit shipped with the gnupg package
|
# This overrides the systemd user unit shipped with the gnupg package
|
||||||
systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
|
systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
|
||||||
serviceConfig.ExecStart = [ "" ''
|
unitConfig = {
|
||||||
${cfg.package}/bin/gpg-agent --supervised \
|
Description = "GnuPG cryptographic agent and passphrase cache";
|
||||||
--pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
|
Documentation = "man:gpg-agent(1)";
|
||||||
'' ];
|
Requires = [ "gpg-agent.socket" ];
|
||||||
|
};
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = "${cfg.package}/bin/gpg-agent --supervised";
|
||||||
|
ExecReload = "${cfg.package}/bin/gpgconf --reload gpg-agent";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.user.sockets.gpg-agent = {
|
systemd.user.sockets.gpg-agent = {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "GnuPG cryptographic agent and passphrase cache";
|
||||||
|
Documentation = "man:gpg-agent(1)";
|
||||||
|
};
|
||||||
|
socketConfig = {
|
||||||
|
ListenStream = "%t/gnupg/S.gpg-agent";
|
||||||
|
FileDescriptorName = "std";
|
||||||
|
SocketMode = "0600";
|
||||||
|
DirectoryMode = "0700";
|
||||||
|
};
|
||||||
wantedBy = [ "sockets.target" ];
|
wantedBy = [ "sockets.target" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.user.sockets.gpg-agent-ssh = mkIf cfg.agent.enableSSHSupport {
|
systemd.user.sockets.gpg-agent-ssh = mkIf cfg.agent.enableSSHSupport {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "GnuPG cryptographic agent (ssh-agent emulation)";
|
||||||
|
Documentation = "man:gpg-agent(1) man:ssh-add(1) man:ssh-agent(1) man:ssh(1)";
|
||||||
|
};
|
||||||
|
socketConfig = {
|
||||||
|
ListenStream = "%t/gnupg/S.gpg-agent.ssh";
|
||||||
|
FileDescriptorName = "ssh";
|
||||||
|
Service = "gpg-agent.service";
|
||||||
|
SocketMode = "0600";
|
||||||
|
DirectoryMode = "0700";
|
||||||
|
};
|
||||||
wantedBy = [ "sockets.target" ];
|
wantedBy = [ "sockets.target" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.user.sockets.gpg-agent-extra = mkIf cfg.agent.enableExtraSocket {
|
systemd.user.sockets.gpg-agent-extra = mkIf cfg.agent.enableExtraSocket {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "GnuPG cryptographic agent and passphrase cache (restricted)";
|
||||||
|
Documentation = "man:gpg-agent(1)";
|
||||||
|
};
|
||||||
|
socketConfig = {
|
||||||
|
ListenStream = "%t/gnupg/S.gpg-agent.extra";
|
||||||
|
FileDescriptorName = "extra";
|
||||||
|
Service = "gpg-agent.service";
|
||||||
|
SocketMode = "0600";
|
||||||
|
DirectoryMode = "0700";
|
||||||
|
};
|
||||||
wantedBy = [ "sockets.target" ];
|
wantedBy = [ "sockets.target" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.user.sockets.gpg-agent-browser = mkIf cfg.agent.enableBrowserSocket {
|
systemd.user.sockets.gpg-agent-browser = mkIf cfg.agent.enableBrowserSocket {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "GnuPG cryptographic agent and passphrase cache (access for web browsers)";
|
||||||
|
Documentation = "man:gpg-agent(1)";
|
||||||
|
};
|
||||||
|
socketConfig = {
|
||||||
|
ListenStream = "%t/gnupg/S.gpg-agent.browser";
|
||||||
|
FileDescriptorName = "browser";
|
||||||
|
Service = "gpg-agent.service";
|
||||||
|
SocketMode = "0600";
|
||||||
|
DirectoryMode = "0700";
|
||||||
|
};
|
||||||
wantedBy = [ "sockets.target" ];
|
wantedBy = [ "sockets.target" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
systemd.user.services.dirmngr = mkIf cfg.dirmngr.enable {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "GnuPG network certificate management daemon";
|
||||||
|
Documentation = "man:dirmngr(8)";
|
||||||
|
Requires = "dirmngr.socket";
|
||||||
|
};
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = "${cfg.package}/bin/dirmngr --supervised";
|
||||||
|
ExecReload = "${cfg.package}/bin/gpgconf --reload dirmngr";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
|
systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "GnuPG network certificate management daemon";
|
||||||
|
Documentation = "man:dirmngr(8)";
|
||||||
|
};
|
||||||
|
socketConfig = {
|
||||||
|
ListenStream = "%t/gnupg/S.dirmngr";
|
||||||
|
SocketMode = "0600";
|
||||||
|
DirectoryMode = "0700";
|
||||||
|
};
|
||||||
wantedBy = [ "sockets.target" ];
|
wantedBy = [ "sockets.target" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
|
services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [ cfg.package ];
|
environment.systemPackages = with pkgs; [ cfg.package ];
|
||||||
systemd.packages = [ cfg.package ];
|
|
||||||
|
|
||||||
environment.interactiveShellInit = ''
|
environment.interactiveShellInit = ''
|
||||||
# Bind gpg-agent to this TTY if gpg commands are used.
|
# Bind gpg-agent to this TTY if gpg commands are used.
|
||||||
|
|
|
@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
|
||||||
|
|
||||||
enableParallelBuilding = true;
|
enableParallelBuilding = true;
|
||||||
|
|
||||||
passthru.tests.connman = lib.nixosTests.gnupg;
|
passthru.tests = lib.nixosTests.gnupg;
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
homepage = "https://gnupg.org";
|
homepage = "https://gnupg.org";
|
||||||
|
|
|
@ -6,6 +6,7 @@
|
||||||
, withPcsc ? !enableMinimal, pcsclite
|
, withPcsc ? !enableMinimal, pcsclite
|
||||||
, guiSupport ? stdenv.isDarwin, pinentry
|
, guiSupport ? stdenv.isDarwin, pinentry
|
||||||
, withTpm2Tss ? !stdenv.isDarwin && !enableMinimal, tpm2-tss
|
, withTpm2Tss ? !stdenv.isDarwin && !enableMinimal, tpm2-tss
|
||||||
|
, nixosTests
|
||||||
}:
|
}:
|
||||||
|
|
||||||
assert guiSupport -> enableMinimal == false;
|
assert guiSupport -> enableMinimal == false;
|
||||||
|
@ -85,7 +86,7 @@ stdenv.mkDerivation rec {
|
||||||
|
|
||||||
enableParallelBuilding = true;
|
enableParallelBuilding = true;
|
||||||
|
|
||||||
passthru.tests.connman = lib.nixosTests.gnupg;
|
passthru.tests = nixosTests.gnupg;
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
homepage = "https://gnupg.org";
|
homepage = "https://gnupg.org";
|
||||||
|
|
Loading…
Reference in a new issue