summaryrefslogtreecommitdiffstats
path: root/tv/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'tv/3modules')
-rw-r--r--tv/3modules/default.nix2
-rw-r--r--tv/3modules/dnsmasq.nix57
-rw-r--r--tv/3modules/ejabberd/config.nix1
-rw-r--r--tv/3modules/slock.nix71
4 files changed, 130 insertions, 1 deletions
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index 493cc8b72..f53a58e9a 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -1,10 +1,12 @@
{
imports = [
./charybdis
+ ./dnsmasq.nix
./ejabberd
./hosts.nix
./iptables.nix
./nixpkgs-overlays.nix
+ ./slock.nix
./x0vncserver.nix
];
}
diff --git a/tv/3modules/dnsmasq.nix b/tv/3modules/dnsmasq.nix
new file mode 100644
index 000000000..ec927f98a
--- /dev/null
+++ b/tv/3modules/dnsmasq.nix
@@ -0,0 +1,57 @@
+with import <stockholm/lib>;
+{ config, ... }: let
+ cfg = config.tv.dnsmasq;
+in {
+
+ options.tv.dnsmasq = {
+ enable = mkEnableOption "tv.dnsmasq";
+ dhcp-range = mkOption {
+ type = types.str;
+ };
+ interface = mkOption {
+ type = types.str;
+ };
+ address = mkOption {
+ type = types.str;
+ };
+ prefixLength = mkOption {
+ type = types.addCheck types.int (x: x >= 0 && x <= 32);
+ };
+ };
+
+ config = mkIf cfg.enable (mkMerge [
+ {
+ networking.dhcpcd.denyInterfaces = [ cfg.interface ];
+ services.dnsmasq.resolveLocalQueries = false;
+ networking.interfaces.${cfg.interface} = {
+ ipv4.addresses = singleton {
+ address = cfg.address;
+ prefixLength = cfg.prefixLength;
+ };
+ };
+ services.dnsmasq.enable = true;
+ services.dnsmasq.extraConfig = ''
+ dhcp-range=${cfg.dhcp-range}
+ interface=${cfg.interface}
+ '';
+ tv.iptables.extra.filter.INPUT = [
+ "-i ${cfg.interface} -p tcp -m tcp --dport bootps -j ACCEPT"
+ "-i ${cfg.interface} -p udp -m udp --dport bootps -j ACCEPT"
+ "-i ${cfg.interface} -p tcp -m tcp --dport domain -j ACCEPT"
+ "-i ${cfg.interface} -p udp -m udp --dport domain -j ACCEPT"
+ ];
+ }
+ {
+ # enable forwarding
+ boot.kernel.sysctl."net.ipv4.ip_forward" = true;
+ tv.iptables.extra.filter.FORWARD = [
+ "-m state --state RELATED,ESTABLISHED -j ACCEPT"
+ "-i ${cfg.interface} -j ACCEPT"
+ ];
+ tv.iptables.extra.nat.POSTROUTING = [
+ "-j MASQUERADE"
+ ];
+ }
+ ]);
+
+}
diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix
index 68bcfa340..a0631e226 100644
--- a/tv/3modules/ejabberd/config.nix
+++ b/tv/3modules/ejabberd/config.nix
@@ -87,7 +87,6 @@ in /* yaml */ ''
mod_configure: {}
mod_disco: {}
mod_echo: {}
- mod_irc: {}
mod_bosh: {}
mod_last: {}
mod_offline:
diff --git a/tv/3modules/slock.nix b/tv/3modules/slock.nix
new file mode 100644
index 000000000..1c84b1e9e
--- /dev/null
+++ b/tv/3modules/slock.nix
@@ -0,0 +1,71 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: let
+ cfg = config.tv.slock;
+in {
+ options.tv.slock = {
+ enable = mkEnableOption "tv.slock";
+ package = mkOption {
+ default = pkgs.execBin "slock" rec {
+ filename = "${pkgs.systemd}/bin/systemctl";
+ argv = [ filename "start" "slock-${cfg.user.name}.service" ];
+ };
+ type = types.package;
+ };
+ user = mkOption {
+ type = types.user;
+ };
+ };
+ config = mkIf cfg.enable {
+ security.polkit.extraConfig = /* js */ ''
+ polkit.addRule(function(action, subject) {
+ if (action.id == "org.freedesktop.systemd1.manage-units" &&
+ action.lookup("unit") == "slock-${cfg.user.name}.service" &&
+ subject.user == ${toJSON cfg.user.name}) {
+ return polkit.Result.YES;
+ }
+ });
+ '';
+ systemd.services."slock-${cfg.user.name}" = {
+ environment = {
+ DISPLAY = ":${toString config.services.xserver.display}";
+ LD_PRELOAD = pkgs.runCommandCC "slock-${cfg.user.name}.so" {
+ passAsFile = ["text"];
+ text = /* c */ ''
+ #include <shadow.h>
+ #include <unistd.h>
+
+ static struct spwd entry = {
+ .sp_namp = "",
+ .sp_pwdp =
+ ${toC config.users.users.${cfg.user.name}.hashedPassword},
+ .sp_lstchg = 0,
+ .sp_min = 0,
+ .sp_max = 0,
+ .sp_warn = 0,
+ .sp_inact = 0,
+ .sp_expire = 0,
+ .sp_flag = 0,
+ };
+
+ extern struct spwd *getspnam(const char *name) { return &entry; }
+ extern int setgroups(size_t size, const gid_t *list) { return 0; }
+ extern int setgid(gid_t gid) { return 0; }
+ extern int setuid(uid_t uid) { return 0; }
+ '';
+ } /* sh */ ''
+ gcc -Wall -shared -o $out -xc "$textPath"
+ '';
+ };
+ restartIfChanged = false;
+ serviceConfig = {
+ ExecStart = "${pkgs.slock}/bin/slock";
+ OOMScoreAdjust = -1000;
+ Restart = "on-failure";
+ RestartSec = "100ms";
+ StartLimitBurst = 0;
+ SyslogIdentifier = "slock";
+ User = cfg.user.name;
+ };
+ };
+ };
+}