2007-11-15 17:16:16 +00:00
|
|
|
|
{ config, pkgs, upstartJobs, systemPath, wrapperDir
|
2008-03-17 13:58:57 +00:00
|
|
|
|
, defaultShell, extraEtc, nixEnvVars, modulesTree, nssModulesPath
|
2007-11-15 17:16:16 +00:00
|
|
|
|
}:
|
2006-12-11 15:32:10 +00:00
|
|
|
|
|
2007-01-16 16:09:43 +00:00
|
|
|
|
let
|
|
|
|
|
|
2007-06-10 20:02:07 +00:00
|
|
|
|
|
2007-11-09 18:49:45 +00:00
|
|
|
|
optional = pkgs.lib.optional;
|
2007-01-16 16:09:43 +00:00
|
|
|
|
|
2007-06-10 20:02:07 +00:00
|
|
|
|
|
|
|
|
|
# !!! ugh, these files shouldn't be created here.
|
|
|
|
|
|
|
|
|
|
|
2008-01-04 17:05:48 +00:00
|
|
|
|
envConf = pkgs.writeText "environment" ''
|
2007-02-06 10:17:13 +00:00
|
|
|
|
PATH=${systemPath}/bin:${systemPath}/sbin:${pkgs.openssh}/bin
|
2007-03-01 15:31:05 +00:00
|
|
|
|
NIX_REMOTE=daemon
|
2008-01-04 17:05:48 +00:00
|
|
|
|
'' /* ${pkgs.openssh}/bin is a hack to get remote scp to work */;
|
2007-06-10 20:02:07 +00:00
|
|
|
|
|
|
|
|
|
|
2008-01-04 17:05:48 +00:00
|
|
|
|
pamConsoleHandlers = pkgs.writeText "console.handlers" ''
|
|
|
|
|
console consoledevs /dev/tty[0-9][0-9]* :[0-9]\.[0-9] :[0-9]
|
|
|
|
|
${pkgs.pam_console}/sbin/pam_console_apply lock logfail wait -t tty -s -c ${pamConsolePerms}
|
|
|
|
|
${pkgs.pam_console}/sbin/pam_console_apply unlock logfail wait -r -t tty -s -c ${pamConsolePerms}
|
|
|
|
|
'';
|
2007-06-10 20:02:07 +00:00
|
|
|
|
|
|
|
|
|
pamConsolePerms = ./security/console.perms;
|
|
|
|
|
|
2007-01-16 16:09:43 +00:00
|
|
|
|
in
|
2007-06-10 20:02:07 +00:00
|
|
|
|
|
2007-01-16 16:09:43 +00:00
|
|
|
|
|
2006-12-11 15:32:10 +00:00
|
|
|
|
import ../helpers/make-etc.nix {
|
|
|
|
|
inherit (pkgs) stdenv;
|
|
|
|
|
|
|
|
|
|
configFiles = [
|
|
|
|
|
{ # TCP/UDP port assignments.
|
|
|
|
|
source = pkgs.iana_etc + "/etc/services";
|
|
|
|
|
target = "services";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
{ # IP protocol numbers.
|
|
|
|
|
source = pkgs.iana_etc + "/etc/protocols";
|
|
|
|
|
target = "protocols";
|
|
|
|
|
}
|
|
|
|
|
|
2008-03-17 12:33:21 +00:00
|
|
|
|
{ # RPC program numbers.
|
|
|
|
|
source = pkgs.glibc + "/etc/rpc";
|
|
|
|
|
target = "rpc";
|
|
|
|
|
}
|
|
|
|
|
|
2006-12-11 15:32:10 +00:00
|
|
|
|
{ # Hostname-to-IP mappings.
|
2008-01-04 17:05:48 +00:00
|
|
|
|
source = pkgs.substituteAll {
|
|
|
|
|
src = ./hosts;
|
|
|
|
|
extraHosts = config.networking.extraHosts;
|
|
|
|
|
};
|
2006-12-11 15:32:10 +00:00
|
|
|
|
target = "hosts";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
{ # Name Service Switch configuration file. Required by the C library.
|
2008-03-17 13:58:57 +00:00
|
|
|
|
source = if config.services.avahi.nssmdns
|
|
|
|
|
then (assert config.services.avahi.enable; ./nsswitch-mdns.conf)
|
|
|
|
|
else ./nsswitch.conf;
|
2006-12-11 15:32:10 +00:00
|
|
|
|
target = "nsswitch.conf";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
{ # Friendly greeting on the virtual consoles.
|
2008-01-04 17:05:48 +00:00
|
|
|
|
source = pkgs.writeText "issue" ''
|
|
|
|
|
|
|
|
|
|
[1;32m${config.services.mingetty.greetingLine}[0m
|
|
|
|
|
${config.services.mingetty.helpLine}
|
|
|
|
|
|
|
|
|
|
'';
|
2006-12-11 15:32:10 +00:00
|
|
|
|
target = "issue";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
{ # Configuration for pwdutils (login, passwd, useradd, etc.).
|
|
|
|
|
# You cannot login without it!
|
2007-03-30 12:59:43 +00:00
|
|
|
|
source = ./login.defs;
|
2006-12-11 15:32:10 +00:00
|
|
|
|
target = "login.defs";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
{ # The Upstart events defined above.
|
|
|
|
|
source = upstartJobs + "/etc/event.d";
|
|
|
|
|
target = "event.d";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
{ # Configuration for passwd and friends (e.g., hash algorithm
|
|
|
|
|
# for /etc/passwd).
|
2007-03-30 12:59:43 +00:00
|
|
|
|
source = ./default/passwd;
|
2006-12-11 15:32:10 +00:00
|
|
|
|
target = "default/passwd";
|
|
|
|
|
}
|
|
|
|
|
|
2007-03-20 13:30:14 +00:00
|
|
|
|
{ # Configuration for useradd.
|
|
|
|
|
source = pkgs.substituteAll {
|
2007-03-30 12:59:43 +00:00
|
|
|
|
src = ./default/useradd;
|
2007-03-20 13:30:14 +00:00
|
|
|
|
inherit defaultShell;
|
|
|
|
|
};
|
|
|
|
|
target = "default/useradd";
|
|
|
|
|
}
|
|
|
|
|
|
2006-12-22 17:28:25 +00:00
|
|
|
|
{ # Dhclient hooks for emitting ip-up/ip-down events.
|
|
|
|
|
source = pkgs.substituteAll {
|
2007-03-30 12:59:43 +00:00
|
|
|
|
src = ./dhclient-exit-hooks;
|
2007-01-23 10:22:00 +00:00
|
|
|
|
inherit (pkgs) upstart glibc;
|
2006-12-22 17:28:25 +00:00
|
|
|
|
};
|
|
|
|
|
target = "dhclient-exit-hooks";
|
|
|
|
|
}
|
2007-01-15 14:43:56 +00:00
|
|
|
|
|
2008-03-12 10:18:11 +00:00
|
|
|
|
{ # Script executed when the shell starts as a non-login shell (system-wide version).
|
|
|
|
|
source = ./bashrc;
|
|
|
|
|
target = "bashrc";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
{ # Script executed when the shell starts as a login shell.
|
2007-01-15 14:43:56 +00:00
|
|
|
|
source = pkgs.substituteAll {
|
2007-03-30 12:59:43 +00:00
|
|
|
|
src = ./profile.sh;
|
2008-03-17 13:58:57 +00:00
|
|
|
|
inherit systemPath wrapperDir modulesTree nssModulesPath;
|
2008-01-06 18:45:13 +00:00
|
|
|
|
inherit (pkgs) glibc;
|
2007-11-09 18:49:45 +00:00
|
|
|
|
timeZone = config.time.timeZone;
|
|
|
|
|
defaultLocale = config.i18n.defaultLocale;
|
2007-11-15 17:16:16 +00:00
|
|
|
|
inherit nixEnvVars;
|
2007-01-15 14:43:56 +00:00
|
|
|
|
};
|
|
|
|
|
target = "profile";
|
|
|
|
|
}
|
2007-01-16 16:09:43 +00:00
|
|
|
|
|
2007-05-02 09:55:35 +00:00
|
|
|
|
{ # Configuration for readline in bash.
|
|
|
|
|
source = ./inputrc;
|
|
|
|
|
target = "inputrc";
|
|
|
|
|
}
|
|
|
|
|
|
2007-11-05 11:19:51 +00:00
|
|
|
|
{ # Nix configuration.
|
2008-01-04 17:05:48 +00:00
|
|
|
|
source = pkgs.writeText "nix.conf" ''
|
2007-11-05 11:19:51 +00:00
|
|
|
|
# WARNING: this file is generated.
|
|
|
|
|
build-users-group = nixbld
|
2007-11-09 18:49:45 +00:00
|
|
|
|
build-max-jobs = ${toString (config.nix.maxJobs)}
|
|
|
|
|
build-use-chroot = ${if config.nix.useChroot then "true" else "false"}
|
2007-11-05 11:19:51 +00:00
|
|
|
|
build-chroot-dirs = /dev /proc /bin /etc
|
2007-11-09 18:49:45 +00:00
|
|
|
|
${config.nix.extraOptions}
|
2008-01-04 17:05:48 +00:00
|
|
|
|
'';
|
2007-11-05 11:19:51 +00:00
|
|
|
|
target = "nix.conf"; # will be symlinked from /nix/etc/nix/nix.conf in activate-configuration.sh.
|
|
|
|
|
}
|
2007-11-08 18:15:12 +00:00
|
|
|
|
|
2008-03-12 10:18:11 +00:00
|
|
|
|
{ # Script executed when the shell starts as a non-login shell (user version).
|
|
|
|
|
source = ./skel/bashrc;
|
|
|
|
|
target = "skel/.bashrc";
|
|
|
|
|
}
|
|
|
|
|
|
2008-01-16 13:59:03 +00:00
|
|
|
|
{ # SSH configuration. Slight duplication of the sshd_config
|
|
|
|
|
# generation in the sshd service.
|
|
|
|
|
source = pkgs.writeText "ssh_config" ''
|
|
|
|
|
${if config.services.sshd.forwardX11 then ''
|
|
|
|
|
ForwardX11 yes
|
|
|
|
|
XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
|
|
|
|
|
'' else ''
|
|
|
|
|
ForwardX11 no
|
|
|
|
|
''}
|
|
|
|
|
'';
|
|
|
|
|
target = "ssh/ssh_config";
|
|
|
|
|
}
|
2006-12-11 15:32:10 +00:00
|
|
|
|
]
|
|
|
|
|
|
2007-11-08 18:15:12 +00:00
|
|
|
|
# Configuration for ssmtp.
|
2007-11-09 18:49:45 +00:00
|
|
|
|
++ optional config.networking.defaultMailServer.directDelivery {
|
2008-01-04 17:05:48 +00:00
|
|
|
|
source = let cfg = config.networking.defaultMailServer; in pkgs.writeText "ssmtp.conf" ''
|
2008-04-24 12:36:50 +00:00
|
|
|
|
MailHub=${cfg.hostName}
|
|
|
|
|
FromLineOverride=YES
|
2008-01-04 17:05:48 +00:00
|
|
|
|
${if cfg.domain != "" then "rewriteDomain=${cfg.domain}" else ""}
|
|
|
|
|
UseTLS=${if cfg.useTLS then "YES" else "NO"}
|
|
|
|
|
UseSTARTTLS=${if cfg.useSTARTTLS then "YES" else "NO"}
|
|
|
|
|
#Debug=YES
|
|
|
|
|
'';
|
2007-11-08 18:15:12 +00:00
|
|
|
|
target = "ssmtp/ssmtp.conf";
|
2007-11-09 18:49:45 +00:00
|
|
|
|
}
|
2007-11-08 18:15:12 +00:00
|
|
|
|
|
2007-01-22 16:42:29 +00:00
|
|
|
|
# Configuration file for fontconfig used to locate
|
|
|
|
|
# (X11) client-rendered fonts.
|
2008-02-14 07:42:52 +00:00
|
|
|
|
++ optional config.fonts.enableFontConfig {
|
2007-01-22 16:42:29 +00:00
|
|
|
|
source = pkgs.runCommand "fonts.conf"
|
|
|
|
|
{
|
2007-09-25 19:00:20 +00:00
|
|
|
|
fontDirectories = import ../system/fonts.nix {inherit pkgs config;};
|
2007-01-22 16:42:29 +00:00
|
|
|
|
buildInputs = [pkgs.libxslt];
|
|
|
|
|
inherit (pkgs) fontconfig;
|
|
|
|
|
}
|
|
|
|
|
"xsltproc --stringparam fontDirectories \"$fontDirectories\" \\
|
2007-10-05 12:56:44 +00:00
|
|
|
|
--stringparam fontconfig \"$fontconfig\" \\
|
2007-03-30 12:59:43 +00:00
|
|
|
|
${./fonts/make-fonts-conf.xsl} $fontconfig/etc/fonts/fonts.conf \\
|
2007-01-22 16:42:29 +00:00
|
|
|
|
> $out
|
|
|
|
|
";
|
|
|
|
|
target = "fonts/fonts.conf";
|
2007-11-09 18:49:45 +00:00
|
|
|
|
}
|
2007-01-22 16:42:29 +00:00
|
|
|
|
|
2007-01-16 16:09:43 +00:00
|
|
|
|
# LDAP configuration.
|
2007-11-09 18:49:45 +00:00
|
|
|
|
++ optional config.users.ldap.enable {
|
2007-04-10 14:10:45 +00:00
|
|
|
|
source = import ./ldap.conf.nix {
|
2007-01-16 16:09:43 +00:00
|
|
|
|
inherit (pkgs) writeText;
|
|
|
|
|
inherit config;
|
|
|
|
|
};
|
|
|
|
|
target = "ldap.conf";
|
2007-11-09 18:49:45 +00:00
|
|
|
|
}
|
2007-01-16 16:09:43 +00:00
|
|
|
|
|
2007-08-16 15:09:06 +00:00
|
|
|
|
# "sudo" configuration.
|
2007-11-09 18:49:45 +00:00
|
|
|
|
++ optional config.security.sudo.enable {
|
2007-08-16 15:09:06 +00:00
|
|
|
|
source = pkgs.runCommand "sudoers"
|
2007-11-09 18:49:45 +00:00
|
|
|
|
{ src = pkgs.writeText "sudoers-in" (config.security.sudo.configFile);
|
2007-08-16 15:09:06 +00:00
|
|
|
|
}
|
|
|
|
|
# Make sure that the sudoers file is syntactically valid.
|
2007-10-10 14:28:40 +00:00
|
|
|
|
# (currently disabled - NIXOS-66)
|
|
|
|
|
#"${pkgs.sudo}/sbin/visudo -f $src -c && cp $src $out";
|
|
|
|
|
"cp $src $out";
|
2007-08-16 15:09:06 +00:00
|
|
|
|
target = "sudoers";
|
|
|
|
|
mode = "0440";
|
2007-11-09 18:49:45 +00:00
|
|
|
|
}
|
2007-08-16 15:09:06 +00:00
|
|
|
|
|
2006-12-11 15:32:10 +00:00
|
|
|
|
# A bunch of PAM configuration files for various programs.
|
|
|
|
|
++ (map
|
|
|
|
|
(program:
|
2007-11-09 18:49:45 +00:00
|
|
|
|
let isLDAPEnabled = config.users.ldap.enable; in
|
2006-12-11 15:32:10 +00:00
|
|
|
|
{ source = pkgs.substituteAll {
|
2007-03-30 12:59:43 +00:00
|
|
|
|
src = ./pam.d + ("/" + program);
|
2007-06-10 20:02:07 +00:00
|
|
|
|
inherit (pkgs) pam_unix2 pam_console;
|
2007-01-16 16:09:43 +00:00
|
|
|
|
pam_ldap =
|
2007-06-10 20:02:07 +00:00
|
|
|
|
if isLDAPEnabled
|
2007-01-16 16:09:43 +00:00
|
|
|
|
then pkgs.pam_ldap
|
|
|
|
|
else "/no-such-path";
|
2007-01-16 22:25:28 +00:00
|
|
|
|
inherit (pkgs.xorg) xauth;
|
2007-06-10 20:02:07 +00:00
|
|
|
|
inherit envConf pamConsoleHandlers;
|
|
|
|
|
isLDAPEnabled = if isLDAPEnabled then "" else "#";
|
2006-12-11 15:32:10 +00:00
|
|
|
|
};
|
|
|
|
|
target = "pam.d/" + program;
|
|
|
|
|
}
|
|
|
|
|
)
|
|
|
|
|
[
|
2008-04-01 10:16:35 +00:00
|
|
|
|
"atd"
|
2006-12-11 15:32:10 +00:00
|
|
|
|
"login"
|
2007-06-05 11:28:18 +00:00
|
|
|
|
"slim"
|
2007-01-11 15:32:48 +00:00
|
|
|
|
"su"
|
2007-07-09 11:21:04 +00:00
|
|
|
|
"sudo"
|
2006-12-16 21:48:12 +00:00
|
|
|
|
"other"
|
2006-12-11 15:32:10 +00:00
|
|
|
|
"passwd"
|
2006-12-16 21:48:12 +00:00
|
|
|
|
"shadow"
|
|
|
|
|
"sshd"
|
2008-03-06 14:38:17 +00:00
|
|
|
|
"lshd"
|
2008-03-06 14:49:06 +00:00
|
|
|
|
"lsh-pam-checkpw"
|
2006-12-11 15:32:10 +00:00
|
|
|
|
"useradd"
|
2007-02-26 21:18:13 +00:00
|
|
|
|
"chsh"
|
2008-03-06 13:52:10 +00:00
|
|
|
|
"xlock"
|
2007-01-30 15:03:43 +00:00
|
|
|
|
"common"
|
2007-06-10 20:02:07 +00:00
|
|
|
|
"common-console" # shared stuff for interactive local sessions
|
2006-12-11 15:32:10 +00:00
|
|
|
|
]
|
2007-03-30 12:55:09 +00:00
|
|
|
|
)
|
|
|
|
|
|
2007-11-15 17:16:16 +00:00
|
|
|
|
# List of machines for distributed Nix builds in the format expected
|
|
|
|
|
# by build-remote.pl.
|
|
|
|
|
++ optional config.nix.distributedBuilds {
|
|
|
|
|
source = pkgs.writeText "nix.machines"
|
|
|
|
|
(pkgs.lib.concatStrings (map (machine:
|
|
|
|
|
"${machine.sshUser}@${machine.hostName} ${machine.system} ${machine.sshKey} ${toString machine.maxJobs}\n"
|
|
|
|
|
) config.nix.buildMachines));
|
|
|
|
|
target = "nix.machines";
|
|
|
|
|
}
|
|
|
|
|
|
2008-06-11 23:06:53 +00:00
|
|
|
|
# unixODBC drivers (this solution is not perfect.. Because the user has to
|
|
|
|
|
# ask the admin to add a driver.. but it's an easy solution which works)
|
|
|
|
|
++ (let inis = config.environment.unixODBCDrivers pkgs;
|
|
|
|
|
in optional ((pkgs.lib.traceWhatis inis) != [] ) {
|
|
|
|
|
source = pkgs.writeText "odbcinst.ini" (pkgs.lib.concatStringsSep "\n" inis);
|
|
|
|
|
target = "odbcinst.ini";
|
|
|
|
|
})
|
|
|
|
|
|
2007-03-30 12:55:09 +00:00
|
|
|
|
# Additional /etc files declared by Upstart jobs.
|
|
|
|
|
++ extraEtc;
|
2007-02-26 21:18:13 +00:00
|
|
|
|
}
|