60 lines
1.7 KiB
Nix
60 lines
1.7 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.infnoise;
|
|
in {
|
|
options = {
|
|
services.infnoise = {
|
|
enable = mkEnableOption (lib.mdDoc "the Infinite Noise TRNG driver");
|
|
|
|
fillDevRandom = mkOption {
|
|
description = lib.mdDoc ''
|
|
Whether to run the infnoise driver as a daemon to refill /dev/random.
|
|
|
|
If disabled, you can use the `infnoise` command-line tool to
|
|
manually obtain randomness.
|
|
'';
|
|
type = types.bool;
|
|
default = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = [ pkgs.infnoise ];
|
|
|
|
services.udev.extraRules = ''
|
|
SUBSYSTEM=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6015", SYMLINK+="infnoise", TAG+="systemd", GROUP="dialout", MODE="0664", ENV{SYSTEMD_WANTS}="infnoise.service"
|
|
'';
|
|
|
|
systemd.services.infnoise = mkIf cfg.fillDevRandom {
|
|
description = "Infinite Noise TRNG driver";
|
|
|
|
bindsTo = [ "dev-infnoise.device" ];
|
|
after = [ "dev-infnoise.device" ];
|
|
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.infnoise}/bin/infnoise --dev-random --debug";
|
|
Restart = "always";
|
|
User = "infnoise";
|
|
DynamicUser = true;
|
|
SupplementaryGroups = [ "dialout" ];
|
|
DeviceAllow = [ "/dev/infnoise" ];
|
|
DevicePolicy = "closed";
|
|
PrivateNetwork = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true; # only reads entropy pool size and watermark
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
};
|
|
};
|
|
};
|
|
}
|