pyrox.dev
Merge pull request #46361 from primeos/nixos-sks
nixos/sks: Minor improvements
authored by Michael Weiss and committed by GitHub 28a46c2c 56b3c5b2
+35
-22
nixos/modules/services/security/sks.nix
+35
-22
nixos/modules/services/security/sks.nix
···
3
with lib;
4
5
let
6
-
7
cfg = config.services.sks;
8
-
9
sksPkg = cfg.package;
10
11
-
in
12
-
13
-
{
14
15
options = {
16
17
services.sks = {
18
19
-
enable = mkEnableOption "sks";
20
21
package = mkOption {
22
default = pkgs.sks;
23
defaultText = "pkgs.sks";
24
type = types.package;
25
-
description = "
26
-
Which sks derivation to use.
27
-
";
28
};
29
30
hkpAddress = mkOption {
31
default = [ "127.0.0.1" "::1" ];
32
type = types.listOf types.str;
33
-
description = "
34
-
Wich ip addresses the sks-keyserver is listening on.
35
-
";
36
};
37
38
hkpPort = mkOption {
39
default = 11371;
40
-
type = types.int;
41
-
description = "
42
-
Which port the sks-keyserver is listening on.
43
-
";
44
};
45
};
46
};
···
51
52
users.users.sks = {
53
createHome = true;
54
-
home = "/var/db/sks";
55
isSystemUser = true;
56
shell = "${pkgs.coreutils}/bin/true";
57
};
···
62
home = config.users.users.sks.home;
63
user = config.users.users.sks.name;
64
in {
65
-
sks-keyserver = {
66
wantedBy = [ "multi-user.target" ];
67
preStart = ''
68
mkdir -p ${home}/dump
69
-
${pkgs.sks}/bin/sks build ${home}/dump/*.gpg -n 10 -cache 100 || true #*/
70
-
${pkgs.sks}/bin/sks cleandb || true
71
-
${pkgs.sks}/bin/sks pbuild -cache 20 -ptree_cache 70 || true
72
'';
73
serviceConfig = {
74
WorkingDirectory = home;
75
User = user;
76
Restart = "always";
77
-
ExecStart = "${pkgs.sks}/bin/sks db -hkp_address ${hkpAddress} -hkp_port ${hkpPort}";
78
};
79
};
80
};
···
3
with lib;
4
5
let
6
cfg = config.services.sks;
7
sksPkg = cfg.package;
8
9
+
in {
10
+
meta.maintainers = with maintainers; [ primeos calbrecht jcumming ];
11
12
options = {
13
14
services.sks = {
15
16
+
enable = mkEnableOption ''
17
+
SKS (synchronizing key server for OpenPGP) and start the database
18
+
server. You need to create "''${dataDir}/dump/*.gpg" for the initial
19
+
import'';
20
21
package = mkOption {
22
default = pkgs.sks;
23
defaultText = "pkgs.sks";
24
type = types.package;
25
+
description = "Which SKS derivation to use.";
26
+
};
27
+
28
+
dataDir = mkOption {
29
+
type = types.path;
30
+
default = "/var/db/sks";
31
+
example = "/var/lib/sks";
32
+
# TODO: The default might change to "/var/lib/sks" as this is more
33
+
# common. There's also https://github.com/NixOS/nixpkgs/issues/26256
34
+
# and "/var/db" is not FHS compliant (seems to come from BSD).
35
+
description = ''
36
+
Data directory (-basedir) for SKS, where the database and all
37
+
configuration files are located (e.g. KDB, PTree, membership and
38
+
sksconf).
39
+
'';
40
};
41
42
hkpAddress = mkOption {
43
default = [ "127.0.0.1" "::1" ];
44
type = types.listOf types.str;
45
+
description = ''
46
+
Domain names, IPv4 and/or IPv6 addresses to listen on for HKP
47
+
requests.
48
+
'';
49
};
50
51
hkpPort = mkOption {
52
default = 11371;
53
+
type = types.ints.u16;
54
+
description = "HKP port to listen on.";
55
};
56
};
57
};
···
62
63
users.users.sks = {
64
createHome = true;
65
+
home = cfg.dataDir;
66
isSystemUser = true;
67
shell = "${pkgs.coreutils}/bin/true";
68
};
···
73
home = config.users.users.sks.home;
74
user = config.users.users.sks.name;
75
in {
76
+
"sks-db" = {
77
+
description = "SKS database server";
78
+
after = [ "network.target" ];
79
wantedBy = [ "multi-user.target" ];
80
preStart = ''
81
mkdir -p ${home}/dump
82
+
${sksPkg}/bin/sks build ${home}/dump/*.gpg -n 10 -cache 100 || true #*/
83
+
${sksPkg}/bin/sks cleandb || true
84
+
${sksPkg}/bin/sks pbuild -cache 20 -ptree_cache 70 || true
85
'';
86
serviceConfig = {
87
WorkingDirectory = home;
88
User = user;
89
Restart = "always";
90
+
ExecStart = "${sksPkg}/bin/sks db -hkp_address ${hkpAddress} -hkp_port ${hkpPort}";
91
};
92
};
93
};