LnL7/nix-darwin
1
1
Fork 0
mirror of https://github.com/LnL7/nix-darwin.git synced 2024-11-09 20:38:22 +03:00
Code Issues Projects Releases Wiki Activity

users: add option to configure nixbld users.

Browse Source
This commit is contained in:
Daiderd Jordan 2018-01-14 16:06:41 +01:00
parent 1ba19da50d
commit 4e0ddf3061
No known key found for this signature in database
GPG Key ID: D02435D05B810C96
2 changed files with 63 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
default.nix
View File

@ -63,6 +63,7 @@ let
./modules/programs/vim.nix
./modules/programs/zsh
./modules/users
./modules/users/nixbld
];
};

62
modules/users/nixbld/default.nix Normal file
View File

@ -0,0 +1,62 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.users;
createdGroups = mapAttrsToList (n: v: v.name) cfg.groups;
createdUsers = mapAttrsToList (n: v: v.name) cfg.users;
mkUsers = f: genList (x: f (x + 1)) cfg.nix.nrBuildUsers;
buildUsers = mkUsers (i: {
name = "nixbld${toString i}";
uid = 30000 + i;
gid = 30000;
description = "Nix build user ${toString i}";
});
buildGroups = [{
name = "nixbld";
gid = 30000;
description = "Nix build group for nix-daemon";
members = map (v: v.name) buildUsers;
}];
in
{
options = {
users.nix.configureBuildUsers = mkOption {
type = types.bool;
default = false;
description = ''
Configuration for nixbld group and users.
NOTE: This does not work unless knownGroups/knownUsers is set.
'';
};
users.nix.nrBuildUsers = mkOption {
type = mkOptionType {
name = "integer";
check = t: isInt t && t > 1;
};
default = 10;
description = "Number of nixbld user accounts created to perform secure concurrent builds.";
};
};
config = {
assertions = [
{ assertion = elem "nixbld" cfg.knownGroups -> elem "nixbld" createdGroups; message = "refusing to delete group nixbld in users.knownGroups, this would break nix"; }
{ assertion = elem "nixbld1" cfg.knownUsers -> elem "nixbld1" createdUsers; message = "refusing to delete user nixbld1 in users.knownUsers, this would break nix"; }
{ assertion = cfg.groups ? "nixbld" -> cfg.groups.nixbld.members != []; message = "refusing to remove all members from nixbld group, this would break nix"; }
];
users.groups = mkIf cfg.nix.configureBuildUsers buildGroups;
users.users = mkIf cfg.nix.configureBuildUsers buildUsers;
};
}