mirror of
https://github.com/LnL7/nix-darwin.git
synced 2024-12-14 11:57:34 +00:00
Reindent/format nix module to more closely match NixOS module
This commit is contained in:
Malo Bourgon
parent
9a5fb50ea9
commit
490ef80485
1 changed files with 364 additions and 350 deletions
|
|
@ -3,6 +3,7 @@
|
|||
with lib;
|
||||
|
||||
let
|
||||
|
||||
cfg = config.nix;
|
||||
|
||||
isNix20 = versionAtLeast (cfg.version or "<unknown>") "1.12pre";
|
||||
|
|
@ -56,6 +57,7 @@ let
|
|||
allowedUsers = "allowed-users";
|
||||
# systemFeatures = "system-features";
|
||||
};
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
|
@ -63,382 +65,393 @@ in
|
|||
mkRenamedOptionModule [ "nix" oldConf ] [ "nix" "settings" newConf ]
|
||||
) legacyConfMappings;
|
||||
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
nix.package = mkOption {
|
||||
type = types.either types.package types.path;
|
||||
default = pkgs.nix;
|
||||
defaultText = "pkgs.nix";
|
||||
example = literalExpression "pkgs.nixUnstable";
|
||||
description = ''
|
||||
This option specifies the package or profile that contains the version of Nix to use throughout the system.
|
||||
To keep the version of nix originally installed the default profile can be used.
|
||||
|
||||
eg. /nix/var/nix/profiles/default
|
||||
'';
|
||||
};
|
||||
nix = {
|
||||
|
||||
# Not in NixOS module
|
||||
nix.version = mkOption {
|
||||
type = types.str;
|
||||
default = "<unknown>";
|
||||
example = "1.11.6";
|
||||
description = "The version of nix. Used to determine what settings to configure in nix.conf";
|
||||
};
|
||||
package = mkOption {
|
||||
type = types.either types.package types.path;
|
||||
default = pkgs.nix;
|
||||
defaultText = "pkgs.nix";
|
||||
example = literalExpression "pkgs.nixUnstable";
|
||||
description = ''
|
||||
This option specifies the package or profile that contains the version of Nix to use throughout the system.
|
||||
To keep the version of nix originally installed the default profile can be used.
|
||||
|
||||
# Not in NixOS module
|
||||
nix.useDaemon = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "
|
||||
If set, Nix will use the daemon to perform operations.
|
||||
Use this instead of services.nix-daemon.enable if you don't wan't the
|
||||
daemon service to be managed for you.
|
||||
";
|
||||
};
|
||||
|
||||
nix.distributedBuilds = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to distribute builds to the machines listed in
|
||||
<option>nix.buildMachines</option>.
|
||||
|
||||
NOTE: This requires services.nix-daemon.enable for a
|
||||
multi-user install.
|
||||
'';
|
||||
};
|
||||
|
||||
# Not in NixOS module
|
||||
nix.daemonNiceLevel = mkOption {
|
||||
type = types.int;
|
||||
default = 0;
|
||||
description = ''
|
||||
Nix daemon process priority. This priority propagates to build processes.
|
||||
0 is the default Unix process priority, 19 is the lowest.
|
||||
'';
|
||||
};
|
||||
|
||||
# Not in NixOS module
|
||||
nix.daemonIONice = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether the Nix daemon process should considered to be low priority when
|
||||
doing file system I/O.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.buildMachines = mkOption {
|
||||
type = types.listOf types.attrs;
|
||||
default = [];
|
||||
example = [
|
||||
{ hostName = "voila.labs.cs.uu.nl";
|
||||
sshUser = "nix";
|
||||
sshKey = "/root/.ssh/id_buildfarm";
|
||||
system = "powerpc-darwin";
|
||||
maxJobs = 1;
|
||||
}
|
||||
{ hostName = "linux64.example.org";
|
||||
sshUser = "buildfarm";
|
||||
sshKey = "/root/.ssh/id_buildfarm";
|
||||
system = "x86_64-linux";
|
||||
maxJobs = 2;
|
||||
supportedFeatures = [ "kvm" ];
|
||||
mandatoryFeatures = [ "perf" ];
|
||||
}
|
||||
];
|
||||
description = ''
|
||||
This option lists the machines to be used if distributed
|
||||
builds are enabled (see
|
||||
<option>nix.distributedBuilds</option>). Nix will perform
|
||||
derivations on those machines via SSH by copying the inputs
|
||||
to the Nix store on the remote machine, starting the build,
|
||||
then copying the output back to the local Nix store. Each
|
||||
element of the list should be an attribute set containing
|
||||
the machine's host name (<varname>hostname</varname>), the
|
||||
user name to be used for the SSH connection
|
||||
(<varname>sshUser</varname>), the Nix system type
|
||||
(<varname>system</varname>, e.g.,
|
||||
<literal>"i686-linux"</literal>), the maximum number of
|
||||
jobs to be run in parallel on that machine
|
||||
(<varname>maxJobs</varname>), the path to the SSH private
|
||||
key to be used to connect (<varname>sshKey</varname>), a
|
||||
list of supported features of the machine
|
||||
(<varname>supportedFeatures</varname>) and a list of
|
||||
mandatory features of the machine
|
||||
(<varname>mandatoryFeatures</varname>). The SSH private key
|
||||
should not have a passphrase, and the corresponding public
|
||||
key should be added to
|
||||
<filename>~<replaceable>sshUser</replaceable>/authorized_keys</filename>
|
||||
on the remote machine.
|
||||
'';
|
||||
};
|
||||
|
||||
# Environment variables for running Nix.
|
||||
nix.envVars = mkOption {
|
||||
type = types.attrs;
|
||||
internal = true;
|
||||
default = {};
|
||||
description = "Environment variables used by Nix.";
|
||||
};
|
||||
|
||||
nix.readOnlyStore = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
If set, NixOS will enforce the immutability of the Nix store
|
||||
by making <filename>/nix/store</filename> a read-only bind
|
||||
mount. Nix will automatically make the store writable when
|
||||
needed.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.nixPath = mkOption {
|
||||
type = mkOptionType {
|
||||
name = "nix path";
|
||||
merge = loc: defs:
|
||||
let
|
||||
values = flatten (map (def:
|
||||
(map (x:
|
||||
if isAttrs x then (mapAttrsToList nameValuePair x)
|
||||
else if isString x then x
|
||||
else throw "The option value `${showOption loc}` in `${def.file}` is not a attset or string.")
|
||||
(if isList def.value then def.value else [def.value]))) defs);
|
||||
|
||||
namedPaths = mapAttrsToList (n: v: "${n}=${(head v).value}")
|
||||
(zipAttrs
|
||||
(map (x: { "${x.name}" = { inherit (x) value; }; })
|
||||
(filter isAttrs values)));
|
||||
|
||||
searchPaths = unique
|
||||
(filter isString values);
|
||||
in
|
||||
namedPaths ++ searchPaths;
|
||||
eg. /nix/var/nix/profiles/default
|
||||
'';
|
||||
};
|
||||
default =
|
||||
[ # Include default path <darwin-config>.
|
||||
{ darwin-config = "${config.environment.darwinConfig}"; }
|
||||
"/nix/var/nix/profiles/per-user/root/channels"
|
||||
"$HOME/.nix-defexpr/channels"
|
||||
|
||||
# Not in NixOS module
|
||||
version = mkOption {
|
||||
type = types.str;
|
||||
default = "<unknown>";
|
||||
example = "1.11.6";
|
||||
description = "The version of nix. Used to determine what settings to configure in nix.conf";
|
||||
};
|
||||
|
||||
# Not in NixOS module
|
||||
useDaemon = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "
|
||||
If set, Nix will use the daemon to perform operations.
|
||||
Use this instead of services.nix-daemon.enable if you don't wan't the
|
||||
daemon service to be managed for you.
|
||||
";
|
||||
};
|
||||
|
||||
distributedBuilds = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to distribute builds to the machines listed in
|
||||
<option>nix.buildMachines</option>.
|
||||
|
||||
NOTE: This requires services.nix-daemon.enable for a
|
||||
multi-user install.
|
||||
'';
|
||||
};
|
||||
|
||||
# Not in NixOS module
|
||||
daemonNiceLevel = mkOption {
|
||||
type = types.int;
|
||||
default = 0;
|
||||
description = ''
|
||||
Nix daemon process priority. This priority propagates to build processes.
|
||||
0 is the default Unix process priority, 19 is the lowest.
|
||||
'';
|
||||
};
|
||||
|
||||
# Not in NixOS module
|
||||
daemonIONice = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether the Nix daemon process should considered to be low priority when
|
||||
doing file system I/O.
|
||||
'';
|
||||
};
|
||||
|
||||
buildMachines = mkOption {
|
||||
type = types.listOf types.attrs;
|
||||
default = [];
|
||||
example = [
|
||||
{ hostName = "voila.labs.cs.uu.nl";
|
||||
sshUser = "nix";
|
||||
sshKey = "/root/.ssh/id_buildfarm";
|
||||
system = "powerpc-darwin";
|
||||
maxJobs = 1;
|
||||
}
|
||||
{ hostName = "linux64.example.org";
|
||||
sshUser = "buildfarm";
|
||||
sshKey = "/root/.ssh/id_buildfarm";
|
||||
system = "x86_64-linux";
|
||||
maxJobs = 2;
|
||||
supportedFeatures = [ "kvm" ];
|
||||
mandatoryFeatures = [ "perf" ];
|
||||
}
|
||||
];
|
||||
example =
|
||||
[ { trunk = "/src/nixpkgs"; }
|
||||
];
|
||||
description = ''
|
||||
The default Nix expression search path, used by the Nix
|
||||
evaluator to look up paths enclosed in angle brackets
|
||||
(e.g. <literal><nixpkgs></literal>).
|
||||
description = ''
|
||||
This option lists the machines to be used if distributed
|
||||
builds are enabled (see
|
||||
<option>nix.distributedBuilds</option>). Nix will perform
|
||||
derivations on those machines via SSH by copying the inputs
|
||||
to the Nix store on the remote machine, starting the build,
|
||||
then copying the output back to the local Nix store. Each
|
||||
element of the list should be an attribute set containing
|
||||
the machine's host name (<varname>hostname</varname>), the
|
||||
user name to be used for the SSH connection
|
||||
(<varname>sshUser</varname>), the Nix system type
|
||||
(<varname>system</varname>, e.g.,
|
||||
<literal>"i686-linux"</literal>), the maximum number of
|
||||
jobs to be run in parallel on that machine
|
||||
(<varname>maxJobs</varname>), the path to the SSH private
|
||||
key to be used to connect (<varname>sshKey</varname>), a
|
||||
list of supported features of the machine
|
||||
(<varname>supportedFeatures</varname>) and a list of
|
||||
mandatory features of the machine
|
||||
(<varname>mandatoryFeatures</varname>). The SSH private key
|
||||
should not have a passphrase, and the corresponding public
|
||||
key should be added to
|
||||
<filename>~<replaceable>sshUser</replaceable>/authorized_keys</filename>
|
||||
on the remote machine.
|
||||
'';
|
||||
};
|
||||
|
||||
Named entries can be specified using an attribute set, if an
|
||||
entry is configured multiple times the value with the lowest
|
||||
ordering will be used.
|
||||
'';
|
||||
};
|
||||
# Environment variables for running Nix.
|
||||
envVars = mkOption {
|
||||
type = types.attrs;
|
||||
internal = true;
|
||||
default = {};
|
||||
description = "Environment variables used by Nix.";
|
||||
};
|
||||
|
||||
nix.registry = mkOption {
|
||||
type = types.attrsOf (types.submodule (
|
||||
let
|
||||
inputAttrs = types.attrsOf (types.oneOf [types.str types.int types.bool types.package]);
|
||||
in
|
||||
{ config, name, ... }:
|
||||
{ options = {
|
||||
from = mkOption {
|
||||
type = inputAttrs;
|
||||
example = { type = "indirect"; id = "nixpkgs"; };
|
||||
description = "The flake reference to be rewritten.";
|
||||
readOnlyStore = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
If set, NixOS will enforce the immutability of the Nix store
|
||||
by making <filename>/nix/store</filename> a read-only bind
|
||||
mount. Nix will automatically make the store writable when
|
||||
needed.
|
||||
'';
|
||||
};
|
||||
|
||||
nixPath = mkOption {
|
||||
type = mkOptionType {
|
||||
name = "nix path";
|
||||
merge = loc: defs:
|
||||
let
|
||||
values = flatten (map (def:
|
||||
(map (x:
|
||||
if isAttrs x then (mapAttrsToList nameValuePair x)
|
||||
else if isString x then x
|
||||
else throw "The option value `${showOption loc}` in `${def.file}` is not a attset or string.")
|
||||
(if isList def.value then def.value else [def.value]))) defs);
|
||||
|
||||
namedPaths = mapAttrsToList (n: v: "${n}=${(head v).value}")
|
||||
(zipAttrs
|
||||
(map (x: { "${x.name}" = { inherit (x) value; }; })
|
||||
(filter isAttrs values)));
|
||||
|
||||
searchPaths = unique
|
||||
(filter isString values);
|
||||
in
|
||||
namedPaths ++ searchPaths;
|
||||
};
|
||||
default =
|
||||
[ # Include default path <darwin-config>.
|
||||
{ darwin-config = "${config.environment.darwinConfig}"; }
|
||||
"/nix/var/nix/profiles/per-user/root/channels"
|
||||
"$HOME/.nix-defexpr/channels"
|
||||
];
|
||||
example =
|
||||
[ { trunk = "/src/nixpkgs"; }
|
||||
];
|
||||
description = ''
|
||||
The default Nix expression search path, used by the Nix
|
||||
evaluator to look up paths enclosed in angle brackets
|
||||
(e.g. <literal><nixpkgs></literal>).
|
||||
|
||||
Named entries can be specified using an attribute set, if an
|
||||
entry is configured multiple times the value with the lowest
|
||||
ordering will be used.
|
||||
'';
|
||||
};
|
||||
|
||||
registry = mkOption {
|
||||
type = types.attrsOf (types.submodule (
|
||||
let
|
||||
inputAttrs = types.attrsOf (types.oneOf [types.str types.int types.bool types.package]);
|
||||
in
|
||||
{ config, name, ... }:
|
||||
{ options = {
|
||||
from = mkOption {
|
||||
type = inputAttrs;
|
||||
example = { type = "indirect"; id = "nixpkgs"; };
|
||||
description = "The flake reference to be rewritten.";
|
||||
};
|
||||
to = mkOption {
|
||||
type = inputAttrs;
|
||||
example = { type = "github"; owner = "my-org"; repo = "my-nixpkgs"; };
|
||||
description = "The flake reference to which <option>from></option> is to be rewritten.";
|
||||
};
|
||||
flake = mkOption {
|
||||
type = types.unspecified;
|
||||
default = null;
|
||||
example = literalExpression "nixpkgs";
|
||||
description = ''
|
||||
The flake input to which <option>from></option> is to be rewritten.
|
||||
'';
|
||||
};
|
||||
exact = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether the <option>from</option> reference needs to match exactly. If set,
|
||||
a <option>from</option> reference like <literal>nixpkgs</literal> does not
|
||||
match with a reference like <literal>nixpkgs/nixos-20.03</literal>.
|
||||
'';
|
||||
};
|
||||
};
|
||||
to = mkOption {
|
||||
type = inputAttrs;
|
||||
example = { type = "github"; owner = "my-org"; repo = "my-nixpkgs"; };
|
||||
description = "The flake reference to which <option>from></option> is to be rewritten.";
|
||||
config = {
|
||||
from = mkDefault { type = "indirect"; id = name; };
|
||||
to = mkIf (config.flake != null)
|
||||
({ type = "path";
|
||||
path = config.flake.outPath;
|
||||
} // lib.filterAttrs
|
||||
(n: v: n == "lastModified" || n == "rev" || n == "revCount" || n == "narHash")
|
||||
config.flake);
|
||||
};
|
||||
flake = mkOption {
|
||||
type = types.unspecified;
|
||||
default = null;
|
||||
example = literalExpression "nixpkgs";
|
||||
description = ''
|
||||
The flake input to which <option>from></option> is to be rewritten.
|
||||
'';
|
||||
};
|
||||
exact = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether the <option>from</option> reference needs to match exactly. If set,
|
||||
a <option>from</option> reference like <literal>nixpkgs</literal> does not
|
||||
match with a reference like <literal>nixpkgs/nixos-20.03</literal>.
|
||||
'';
|
||||
};
|
||||
};
|
||||
config = {
|
||||
from = mkDefault { type = "indirect"; id = name; };
|
||||
to = mkIf (config.flake != null)
|
||||
({ type = "path";
|
||||
path = config.flake.outPath;
|
||||
} // lib.filterAttrs
|
||||
(n: v: n == "lastModified" || n == "rev" || n == "revCount" || n == "narHash")
|
||||
config.flake);
|
||||
};
|
||||
}
|
||||
));
|
||||
default = {};
|
||||
description = ''
|
||||
A system-wide flake registry.
|
||||
'';
|
||||
};
|
||||
}
|
||||
));
|
||||
default = {};
|
||||
description = ''
|
||||
A system-wide flake registry.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.extraOptions = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
example = ''
|
||||
gc-keep-outputs = true
|
||||
gc-keep-derivations = true
|
||||
'';
|
||||
description = "Additional text appended to <filename>nix.conf</filename>.";
|
||||
};
|
||||
extraOptions = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
example = ''
|
||||
gc-keep-outputs = true
|
||||
gc-keep-derivations = true
|
||||
'';
|
||||
description = "Additional text appended to <filename>nix.conf</filename>.";
|
||||
};
|
||||
|
||||
nix.settings.max-jobs = mkOption {
|
||||
type = types.either types.int (types.enum [ "auto" ]);
|
||||
default = "auto";
|
||||
example = 64;
|
||||
description = ''
|
||||
This option defines the maximum number of jobs that Nix will try to
|
||||
build in parallel. The default is auto, which means it will use all
|
||||
available logical cores. It is recommend to set it to the total
|
||||
number of logical cores in your system (e.g., 16 for two CPUs with 4
|
||||
cores each and hyper-threading).
|
||||
'';
|
||||
};
|
||||
settings = {
|
||||
max-jobs = mkOption {
|
||||
type = types.either types.int (types.enum [ "auto" ]);
|
||||
default = "auto";
|
||||
example = 64;
|
||||
description = ''
|
||||
This option defines the maximum number of jobs that Nix will try to
|
||||
build in parallel. The default is auto, which means it will use all
|
||||
available logical cores. It is recommend to set it to the total
|
||||
number of logical cores in your system (e.g., 16 for two CPUs with 4
|
||||
cores each and hyper-threading).
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.auto-optimise-store = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = ''
|
||||
If set to true, Nix automatically detects files in the store that have
|
||||
identical contents, and replaces them with hard links to a single copy.
|
||||
This saves disk space. If set to false (the default), you can still run
|
||||
nix-store --optimise to get rid of duplicate files.
|
||||
'';
|
||||
};
|
||||
auto-optimise-store = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
example = true;
|
||||
description = ''
|
||||
If set to true, Nix automatically detects files in the store that have
|
||||
identical contents, and replaces them with hard links to a single copy.
|
||||
This saves disk space. If set to false (the default), you can still run
|
||||
nix-store --optimise to get rid of duplicate files.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.cores = mkOption {
|
||||
type = types.int;
|
||||
default = 0;
|
||||
example = 64;
|
||||
description = ''
|
||||
This option defines the maximum number of concurrent tasks during
|
||||
one build. It affects, e.g., -j option for make.
|
||||
The special value 0 means that the builder should use all
|
||||
available CPU cores in the system. Some builds may become
|
||||
non-deterministic with this option; use with care! Packages will
|
||||
only be affected if enableParallelBuilding is set for them.
|
||||
'';
|
||||
};
|
||||
cores = mkOption {
|
||||
type = types.int;
|
||||
default = 0;
|
||||
example = 64;
|
||||
description = ''
|
||||
This option defines the maximum number of concurrent tasks during
|
||||
one build. It affects, e.g., -j option for make.
|
||||
The special value 0 means that the builder should use all
|
||||
available CPU cores in the system. Some builds may become
|
||||
non-deterministic with this option; use with care! Packages will
|
||||
only be affected if enableParallelBuilding is set for them.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.sandbox = mkOption {
|
||||
type = types.either types.bool (types.enum [ "relaxed" ]);
|
||||
default = false;
|
||||
description = ''
|
||||
If set, Nix will perform builds in a sandboxed environment that it
|
||||
will set up automatically for each build. This prevents impurities
|
||||
in builds by disallowing access to dependencies outside of the Nix
|
||||
store by using network and mount namespaces in a chroot environment.
|
||||
This is enabled by default even though it has a possible performance
|
||||
impact due to the initial setup time of a sandbox for each build. It
|
||||
doesn't affect derivation hashes, so changing this option will not
|
||||
trigger a rebuild of packages.
|
||||
'';
|
||||
};
|
||||
sandbox = mkOption {
|
||||
type = types.either types.bool (types.enum [ "relaxed" ]);
|
||||
default = false;
|
||||
description = ''
|
||||
If set, Nix will perform builds in a sandboxed environment that it
|
||||
will set up automatically for each build. This prevents impurities
|
||||
in builds by disallowing access to dependencies outside of the Nix
|
||||
store by using network and mount namespaces in a chroot environment.
|
||||
This is enabled by default even though it has a possible performance
|
||||
impact due to the initial setup time of a sandbox for each build. It
|
||||
doesn't affect derivation hashes, so changing this option will not
|
||||
trigger a rebuild of packages.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.extra-sandbox-paths = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
example = [ "/dev" "/proc" ];
|
||||
description = ''
|
||||
Directories from the host filesystem to be included
|
||||
in the sandbox.
|
||||
'';
|
||||
};
|
||||
extra-sandbox-paths = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
example = [ "/dev" "/proc" ];
|
||||
description = ''
|
||||
Directories from the host filesystem to be included
|
||||
in the sandbox.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.substituters = mkOption {
|
||||
type = types.listOf types.str;
|
||||
description = ''
|
||||
List of binary cache URLs used to obtain pre-built binaries
|
||||
of Nix packages.
|
||||
substituters = mkOption {
|
||||
type = types.listOf types.str;
|
||||
description = ''
|
||||
List of binary cache URLs used to obtain pre-built binaries
|
||||
of Nix packages.
|
||||
|
||||
By default https://cache.nixos.org/ is added.
|
||||
'';
|
||||
};
|
||||
By default https://cache.nixos.org/ is added.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.trusted-substituters = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
example = [ "https://hydra.nixos.org/" ];
|
||||
description = ''
|
||||
List of binary cache URLs that non-root users can use (in
|
||||
addition to those specified using
|
||||
<option>nix.settings.substituters</option>) by passing
|
||||
<literal>--option binary-caches</literal> to Nix commands.
|
||||
'';
|
||||
};
|
||||
trusted-substituters = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
example = [ "https://hydra.nixos.org/" ];
|
||||
description = ''
|
||||
List of binary cache URLs that non-root users can use (in
|
||||
addition to those specified using
|
||||
<option>nix.settings.substituters</option>) by passing
|
||||
<literal>--option binary-caches</literal> to Nix commands.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.require-sigs = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
If enabled (the default), Nix will only download binaries from binary caches if
|
||||
they are cryptographically signed with any of the keys listed in
|
||||
<option>nix.settings.trusted-public-keys</option>. If disabled, signatures are neither
|
||||
required nor checked, so it's strongly recommended that you use only
|
||||
trustworthy caches and https to prevent man-in-the-middle attacks.
|
||||
'';
|
||||
};
|
||||
require-sigs = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
If enabled (the default), Nix will only download binaries from binary caches if
|
||||
they are cryptographically signed with any of the keys listed in
|
||||
<option>nix.settings.trusted-public-keys</option>. If disabled, signatures are neither
|
||||
required nor checked, so it's strongly recommended that you use only
|
||||
trustworthy caches and https to prevent man-in-the-middle attacks.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.trusted-public-keys = mkOption {
|
||||
type = types.listOf types.str;
|
||||
example = [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ];
|
||||
description = ''
|
||||
List of public keys used to sign binary caches. If
|
||||
<option>nix.settings.trusted-public-keys</option> is enabled,
|
||||
then Nix will use a binary from a binary cache if and only
|
||||
if it is signed by <emphasis>any</emphasis> of the keys
|
||||
listed here. By default, only the key for
|
||||
<uri>cache.nixos.org</uri> is included.
|
||||
'';
|
||||
};
|
||||
trusted-public-keys = mkOption {
|
||||
type = types.listOf types.str;
|
||||
example = [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ];
|
||||
description = ''
|
||||
List of public keys used to sign binary caches. If
|
||||
<option>nix.settings.trusted-public-keys</option> is enabled,
|
||||
then Nix will use a binary from a binary cache if and only
|
||||
if it is signed by <emphasis>any</emphasis> of the keys
|
||||
listed here. By default, only the key for
|
||||
<uri>cache.nixos.org</uri> is included.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.trusted-users = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "root" ];
|
||||
example = [ "root" "alice" "@wheel" ];
|
||||
description = ''
|
||||
A list of names of users that have additional rights when
|
||||
connecting to the Nix daemon, such as the ability to specify
|
||||
additional binary caches, or to import unsigned NARs. You
|
||||
can also specify groups by prefixing them with
|
||||
<literal>@</literal>; for instance,
|
||||
<literal>@wheel</literal> means all users in the wheel
|
||||
group.
|
||||
'';
|
||||
};
|
||||
trusted-users = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "root" ];
|
||||
example = [ "root" "alice" "@wheel" ];
|
||||
description = ''
|
||||
A list of names of users that have additional rights when
|
||||
connecting to the Nix daemon, such as the ability to specify
|
||||
additional binary caches, or to import unsigned NARs. You
|
||||
can also specify groups by prefixing them with
|
||||
<literal>@</literal>; for instance,
|
||||
<literal>@wheel</literal> means all users in the wheel
|
||||
group.
|
||||
'';
|
||||
};
|
||||
|
||||
nix.settings.allowed-users = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "*" ];
|
||||
example = [ "@wheel" "@builders" "alice" "bob" ];
|
||||
description = ''
|
||||
A list of names of users (separated by whitespace) that are
|
||||
allowed to connect to the Nix daemon. As with
|
||||
<option>nix.settings.trusted-users</option>, you can specify groups by
|
||||
prefixing them with <literal>@</literal>. Also, you can
|
||||
allow all users by specifying <literal>*</literal>. The
|
||||
default is <literal>*</literal>. Note that trusted users are
|
||||
always allowed to connect.
|
||||
'';
|
||||
allowed-users = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ "*" ];
|
||||
example = [ "@wheel" "@builders" "alice" "bob" ];
|
||||
description = ''
|
||||
A list of names of users (separated by whitespace) that are
|
||||
allowed to connect to the Nix daemon. As with
|
||||
<option>nix.settings.trusted-users</option>, you can specify groups by
|
||||
prefixing them with <literal>@</literal>. Also, you can
|
||||
allow all users by specifying <literal>*</literal>. The
|
||||
default is <literal>*</literal>. Note that trusted users are
|
||||
always allowed to connect.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
###### implementation
|
||||
|
||||
config = {
|
||||
|
||||
warnings = [
|
||||
|
|
@ -527,4 +540,5 @@ in
|
|||
'';
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue