summaryrefslogtreecommitdiffstats
path: root/tv/3modules
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2023-01-18 17:13:30 +0100
committertv <tv@krebsco.de>2023-01-18 17:23:38 +0100
commitdc5e0cff29929fb6019511ec7b6ddb6f31d7a6e4 (patch)
tree8c99fd62f092a15ae1d365d64f57ba137cb8195b /tv/3modules
parent6e0c2f1927eea59a3f8b8e58bfdc9193fc20d324 (diff)
tv.systemd.services.*.operators: init
Diffstat (limited to 'tv/3modules')
-rw-r--r--tv/3modules/default.nix1
-rw-r--r--tv/3modules/systemd.nix46
2 files changed, 47 insertions, 0 deletions
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index ea3efbc..c49f158 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -10,6 +10,7 @@
./iptables.nix
./lidControl.nix
./org.freedesktop.machine1.host-shell.nix
+ ./systemd.nix
./slock.nix
./x0vncserver.nix
./Xresources.nix
diff --git a/tv/3modules/systemd.nix b/tv/3modules/systemd.nix
new file mode 100644
index 0000000..bbbab06
--- /dev/null
+++ b/tv/3modules/systemd.nix
@@ -0,0 +1,46 @@
+with import ./lib;
+{ config, ... }: let
+ normalUsers = filterAttrs (_: getAttr "isNormalUser") config.users.users;
+in {
+ options = {
+ tv.systemd.services = mkOption {
+ type = types.attrsOf (types.submodule (self: {
+ options = {
+ operators = mkOption {
+ type = with types; listOf (enum (attrNames normalUsers));
+ default = [];
+ };
+ };
+ }));
+ };
+ };
+ config = {
+ security.polkit.extraConfig = let
+ access =
+ mapAttrs'
+ (name: cfg:
+ nameValuePair "${name}.service"
+ (genAttrs cfg.operators (const true))
+ )
+ config.tv.systemd.services;
+ in optionalString (access != {}) /* js */ ''
+ polkit.addRule(function () {
+ const access = ${lib.toJSON access};
+ return function (action, subject) {
+ if (action.id === "org.freedesktop.systemd1.manage-units") {
+ const unit = action.lookup("unit");
+ if (
+ (access[unit]||{})[subject.user] ||
+ (
+ unit.includes("@") &&
+ (access[unit.replace(/@[^.]+/, "@")]||{})[subject.user]
+ )
+ ) {
+ return polkit.Result.YES;
+ }
+ }
+ }
+ }());
+ '';
+ };
+}