156 lines
4.1 KiB
Nix
156 lines
4.1 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.physlock;
|
|
in
|
|
|
|
{
|
|
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
services.physlock = {
|
|
|
|
enable = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether to enable the {command}`physlock` screen locking mechanism.
|
|
|
|
Enable this and then run {command}`systemctl start physlock`
|
|
to securely lock the screen.
|
|
|
|
This will switch to a new virtual terminal, turn off console
|
|
switching and disable SysRq mechanism (when
|
|
{option}`services.physlock.disableSysRq` is set)
|
|
until the root or user password is given.
|
|
'';
|
|
};
|
|
|
|
allowAnyUser = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether to allow any user to lock the screen. This will install a
|
|
setuid wrapper to allow any user to start physlock as root, which
|
|
is a minor security risk. Call the physlock binary to use this instead
|
|
of using the systemd service.
|
|
'';
|
|
};
|
|
|
|
disableSysRq = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = ''
|
|
Whether to disable SysRq when locked with physlock.
|
|
'';
|
|
};
|
|
|
|
lockMessage = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "";
|
|
description = ''
|
|
Message to show on physlock login terminal.
|
|
'';
|
|
};
|
|
|
|
muteKernelMessages = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Disable kernel messages on console while physlock is running.
|
|
'';
|
|
};
|
|
|
|
lockOn = {
|
|
|
|
suspend = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = ''
|
|
Whether to lock screen with physlock just before suspend.
|
|
'';
|
|
};
|
|
|
|
hibernate = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = ''
|
|
Whether to lock screen with physlock just before hibernate.
|
|
'';
|
|
};
|
|
|
|
extraTargets = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
example = [ "display-manager.service" ];
|
|
description = ''
|
|
Other targets to lock the screen just before.
|
|
|
|
Useful if you want to e.g. both autologin to X11 so that
|
|
your {file}`~/.xsession` gets executed and
|
|
still to have the screen locked so that the system can be
|
|
booted relatively unattended.
|
|
'';
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
###### implementation
|
|
|
|
config = lib.mkIf cfg.enable (
|
|
lib.mkMerge [
|
|
{
|
|
|
|
# for physlock -l and physlock -L
|
|
environment.systemPackages = [ pkgs.physlock ];
|
|
|
|
systemd.services.physlock = {
|
|
enable = true;
|
|
description = "Physlock";
|
|
wantedBy =
|
|
lib.optional cfg.lockOn.suspend "suspend.target"
|
|
++ lib.optional cfg.lockOn.hibernate "hibernate.target"
|
|
++ cfg.lockOn.extraTargets;
|
|
before =
|
|
lib.optional cfg.lockOn.suspend "systemd-suspend.service"
|
|
++ lib.optional cfg.lockOn.hibernate "systemd-hibernate.service"
|
|
++ lib.optional (
|
|
cfg.lockOn.hibernate || cfg.lockOn.suspend
|
|
) "systemd-suspend-then-hibernate.service"
|
|
++ cfg.lockOn.extraTargets;
|
|
serviceConfig = {
|
|
Type = "forking";
|
|
ExecStart = "${pkgs.physlock}/bin/physlock -d${lib.optionalString cfg.muteKernelMessages "m"}${lib.optionalString cfg.disableSysRq "s"}${
|
|
lib.optionalString (cfg.lockMessage != "") " -p \"${cfg.lockMessage}\""
|
|
}";
|
|
};
|
|
};
|
|
|
|
security.pam.services.physlock = { };
|
|
|
|
}
|
|
|
|
(lib.mkIf cfg.allowAnyUser {
|
|
|
|
security.wrappers.physlock = {
|
|
setuid = true;
|
|
owner = "root";
|
|
group = "root";
|
|
source = "${pkgs.physlock}/bin/physlock";
|
|
};
|
|
|
|
})
|
|
]
|
|
);
|
|
|
|
}
|