diff options
author | Jan Malakhovski <oxij@oxij.org> | 2015-04-21 00:13:42 +0000 |
---|---|---|
committer | Jan Malakhovski <oxij@oxij.org> | 2015-09-18 19:12:34 +0000 |
commit | 75ba6b553ca3ed0f40b568e3fe0c54f55f47228f (patch) | |
tree | 2f694c3bab4f67bb658526c3a57fd89ac12e1e1f /nixos/modules/services/security/physlock.nix | |
parent | c8ea6c07c655ba70cf46c52063276bfcfa5b1643 (diff) |
nixos: add physlock service
Diffstat (limited to 'nixos/modules/services/security/physlock.nix')
-rw-r--r-- | nixos/modules/services/security/physlock.nix | 114 |
1 files changed, 114 insertions, 0 deletions
diff --git a/nixos/modules/services/security/physlock.nix b/nixos/modules/services/security/physlock.nix new file mode 100644 index 0000000000000..34d0be3b1beb9 --- /dev/null +++ b/nixos/modules/services/security/physlock.nix @@ -0,0 +1,114 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.physlock; +in + +{ + + ###### interface + + options = { + + services.physlock = { + + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable the <command>physlock</command> screen locking mechanism. + + Enable this and then run <command>systemctl start physlock</command> + to securely lock the screen. + + This will switch to a new virtual terminal, turn off console + switching and disable SysRq mechanism (when + <option>services.physlock.disableSysRq</option> is set) + until the root or <option>services.physlock.user</option> + password is given. + ''; + }; + + user = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + User whose password will be used to unlock the screen on par + with the root password. + ''; + }; + + disableSysRq = mkOption { + type = types.bool; + default = true; + description = '' + Whether to disable SysRq when locked with physlock. + ''; + }; + + lockOn = { + + suspend = mkOption { + type = types.bool; + default = true; + description = '' + Whether to lock screen with physlock just before suspend. + ''; + }; + + hibernate = mkOption { + type = types.bool; + default = true; + description = '' + Whether to lock screen with physlock just before hibernate. + ''; + }; + + extraTargets = mkOption { + type = types.listOf types.str; + default = []; + example = [ "display-manager.service" ]; + description = '' + Other targets to lock the screen just before. + + Useful if you want to e.g. both autologin to X11 so that + your <filename>~/.xsession</filename> gets executed and + still to have the screen locked so that the system can be + booted relatively unattended. + ''; + }; + + }; + + }; + + }; + + + ###### implementation + + config = mkIf cfg.enable { + + # for physlock -l and physlock -L + environment.systemPackages = [ pkgs.physlock ]; + + systemd.services."physlock" = { + enable = true; + description = "Physlock"; + wantedBy = optional cfg.lockOn.suspend "suspend.target" + ++ optional cfg.lockOn.hibernate "hibernate.target" + ++ cfg.lockOn.extraTargets; + before = optional cfg.lockOn.suspend "systemd-suspend.service" + ++ optional cfg.lockOn.hibernate "systemd-hibernate.service" + ++ cfg.lockOn.extraTargets; + serviceConfig.Type = "forking"; + script = '' + ${pkgs.physlock}/bin/physlock -d${optionalString cfg.disableSysRq "s"}${optionalString (cfg.user != null) " -u ${cfg.user}"} + ''; + }; + + }; + +} |