nixos/cage: init
Add a cage module to nixos. This can be used to make kiosk-style systems that boot directly to a single application. The user (demo by default) is automatically logged in by this service and the program (xterm by default) is automatically started. This is useful for some embedded, single-user systems where we want automatic booting. To keep the system secure, the user should have limited privileges. Based on the service provided in the Cage wiki here: https://github.com/Hjdskes/cage/wiki/Starting-Cage-on-boot-with-systemd Co-Authored-By: Florian Klink <flokli@flokli.de>
This commit is contained in:
parent
c6c200f118
commit
e0e4d591cc
|
@ -807,6 +807,7 @@
|
||||||
./services/ttys/agetty.nix
|
./services/ttys/agetty.nix
|
||||||
./services/ttys/gpm.nix
|
./services/ttys/gpm.nix
|
||||||
./services/ttys/kmscon.nix
|
./services/ttys/kmscon.nix
|
||||||
|
./services/wayland/cage.nix
|
||||||
./services/web-apps/atlassian/confluence.nix
|
./services/web-apps/atlassian/confluence.nix
|
||||||
./services/web-apps/atlassian/crowd.nix
|
./services/web-apps/atlassian/crowd.nix
|
||||||
./services/web-apps/atlassian/jira.nix
|
./services/web-apps/atlassian/jira.nix
|
||||||
|
|
99
nixos/modules/services/wayland/cage.nix
Normal file
99
nixos/modules/services/wayland/cage.nix
Normal file
|
@ -0,0 +1,99 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.cage;
|
||||||
|
in {
|
||||||
|
options.services.cage.enable = mkEnableOption "cage kiosk service";
|
||||||
|
|
||||||
|
options.services.cage.user = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "demo";
|
||||||
|
description = ''
|
||||||
|
User to log-in as.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
options.services.cage.extraArguments = mkOption {
|
||||||
|
type = types.listOf types.str;
|
||||||
|
default = [];
|
||||||
|
defaultText = "[]";
|
||||||
|
description = "Additional command line arguments to pass to Cage.";
|
||||||
|
example = ["-d"];
|
||||||
|
};
|
||||||
|
|
||||||
|
options.services.cage.program = mkOption {
|
||||||
|
type = types.path;
|
||||||
|
default = "${pkgs.xterm}/bin/xterm";
|
||||||
|
description = ''
|
||||||
|
Program to run in cage.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
|
||||||
|
# The service is partially based off of the one provided in the
|
||||||
|
# cage wiki at
|
||||||
|
# https://github.com/Hjdskes/cage/wiki/Starting-Cage-on-boot-with-systemd.
|
||||||
|
systemd.services."cage-tty1" = {
|
||||||
|
enable = true;
|
||||||
|
after = [
|
||||||
|
"systemd-user-sessions.service"
|
||||||
|
"plymouth-start.service"
|
||||||
|
"plymouth-quit.service"
|
||||||
|
"systemd-logind.service"
|
||||||
|
"getty@tty1.service"
|
||||||
|
];
|
||||||
|
before = [ "graphical.target" ];
|
||||||
|
wants = [ "dbus.socket" "systemd-logind.service" "plymouth-quit.service"];
|
||||||
|
wantedBy = [ "graphical.target" ];
|
||||||
|
conflicts = [ "getty@tty1.service" ];
|
||||||
|
|
||||||
|
restartIfChanged = false;
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = ''
|
||||||
|
${pkgs.cage}/bin/cage \
|
||||||
|
${escapeShellArgs cfg.extraArguments} \
|
||||||
|
-- ${cfg.program}
|
||||||
|
'';
|
||||||
|
User = cfg.user;
|
||||||
|
|
||||||
|
ConditionPathExists = "/dev/tty1";
|
||||||
|
IgnoreSIGPIPE = "no";
|
||||||
|
|
||||||
|
# Log this user with utmp, letting it show up with commands 'w' and
|
||||||
|
# 'who'. This is needed since we replace (a)getty.
|
||||||
|
UtmpIdentifier = "%n";
|
||||||
|
UtmpMode = "user";
|
||||||
|
# A virtual terminal is needed.
|
||||||
|
TTYPath = "/dev/tty1";
|
||||||
|
TTYReset = "yes";
|
||||||
|
TTYVHangup = "yes";
|
||||||
|
TTYVTDisallocate = "yes";
|
||||||
|
# Fail to start if not controlling the virtual terminal.
|
||||||
|
StandardInput = "tty-fail";
|
||||||
|
StandardOutput = "syslog";
|
||||||
|
StandardError = "syslog";
|
||||||
|
# Set up a full (custom) user session for the user, required by Cage.
|
||||||
|
PAMName = "cage";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
security.pam.services.cage.text = ''
|
||||||
|
auth required pam_unix.so nullok
|
||||||
|
account required pam_unix.so
|
||||||
|
session required pam_unix.so
|
||||||
|
session required ${pkgs.systemd}/lib/security/pam_systemd.so
|
||||||
|
'';
|
||||||
|
|
||||||
|
hardware.opengl.enable = mkDefault true;
|
||||||
|
|
||||||
|
systemd.targets.graphical.wants = [ "cage-tty1.service" ];
|
||||||
|
|
||||||
|
systemd.defaultUnit = "graphical.target";
|
||||||
|
};
|
||||||
|
|
||||||
|
meta.maintainers = with lib.maintainers; [ matthewbauer flokli ];
|
||||||
|
|
||||||
|
}
|
|
@ -39,6 +39,7 @@ in
|
||||||
buildbot = handleTest ./buildbot.nix {};
|
buildbot = handleTest ./buildbot.nix {};
|
||||||
caddy = handleTest ./caddy.nix {};
|
caddy = handleTest ./caddy.nix {};
|
||||||
cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
|
cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
|
||||||
|
cage = handleTest ./cage.nix {};
|
||||||
cassandra = handleTest ./cassandra.nix {};
|
cassandra = handleTest ./cassandra.nix {};
|
||||||
ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
|
ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
|
||||||
ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
|
ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
|
||||||
|
|
43
nixos/tests/cage.nix
Normal file
43
nixos/tests/cage.nix
Normal file
|
@ -0,0 +1,43 @@
|
||||||
|
import ./make-test-python.nix ({ pkgs, ...} :
|
||||||
|
|
||||||
|
{
|
||||||
|
name = "cage";
|
||||||
|
meta = with pkgs.stdenv.lib.maintainers; {
|
||||||
|
maintainers = [ matthewbauer flokli ];
|
||||||
|
};
|
||||||
|
|
||||||
|
machine = { ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [ ./common/user-account.nix ];
|
||||||
|
services.cage = {
|
||||||
|
enable = true;
|
||||||
|
user = "alice";
|
||||||
|
program = "${pkgs.xterm}/bin/xterm -cm -pc"; # disable color and bold to make OCR easier
|
||||||
|
};
|
||||||
|
|
||||||
|
# this needs a fairly recent kernel, otherwise:
|
||||||
|
# [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
|
||||||
|
# [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
|
||||||
|
# [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
|
||||||
|
# [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
|
||||||
|
# [backend/drm/drm.c:618] Failed to initialize renderer on connector 'Virtual-1': initial page-flip failed
|
||||||
|
# [backend/drm/drm.c:701] Failed to initialize renderer for plane
|
||||||
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||||
|
|
||||||
|
virtualisation.memorySize = 1024;
|
||||||
|
};
|
||||||
|
|
||||||
|
enableOCR = true;
|
||||||
|
|
||||||
|
testScript = { nodes, ... }: let
|
||||||
|
user = nodes.machine.config.users.users.alice;
|
||||||
|
in ''
|
||||||
|
with subtest("Wait for cage to boot up"):
|
||||||
|
start_all()
|
||||||
|
machine.wait_for_file("/run/user/${toString user.uid}/wayland-0.lock")
|
||||||
|
machine.wait_until_succeeds("pgrep xterm")
|
||||||
|
machine.wait_for_text("alice@machine")
|
||||||
|
machine.screenshot("screen")
|
||||||
|
'';
|
||||||
|
})
|
Loading…
Reference in a new issue