Add a cage module to nixos. This can be used to make kiosk-style systems that boot directly to a single application. The user (demo by default) is automatically logged in by this service and the program (xterm by default) is automatically started. This is useful for some embedded, single-user systems where we want automatic booting. To keep the system secure, the user should have limited privileges. Based on the service provided in the Cage wiki here: https://github.com/Hjdskes/cage/wiki/Starting-Cage-on-boot-with-systemd Co-Authored-By: Florian Klink <flokli@flokli.de>wip/yesman
parent
c6c200f118
commit
e0e4d591cc
@ -0,0 +1,99 @@ |
||||
{ config, pkgs, lib, ... }: |
||||
|
||||
with lib; |
||||
|
||||
let |
||||
cfg = config.services.cage; |
||||
in { |
||||
options.services.cage.enable = mkEnableOption "cage kiosk service"; |
||||
|
||||
options.services.cage.user = mkOption { |
||||
type = types.str; |
||||
default = "demo"; |
||||
description = '' |
||||
User to log-in as. |
||||
''; |
||||
}; |
||||
|
||||
options.services.cage.extraArguments = mkOption { |
||||
type = types.listOf types.str; |
||||
default = []; |
||||
defaultText = "[]"; |
||||
description = "Additional command line arguments to pass to Cage."; |
||||
example = ["-d"]; |
||||
}; |
||||
|
||||
options.services.cage.program = mkOption { |
||||
type = types.path; |
||||
default = "${pkgs.xterm}/bin/xterm"; |
||||
description = '' |
||||
Program to run in cage. |
||||
''; |
||||
}; |
||||
|
||||
config = mkIf cfg.enable { |
||||
|
||||
# The service is partially based off of the one provided in the |
||||
# cage wiki at |
||||
# https://github.com/Hjdskes/cage/wiki/Starting-Cage-on-boot-with-systemd. |
||||
systemd.services."cage-tty1" = { |
||||
enable = true; |
||||
after = [ |
||||
"systemd-user-sessions.service" |
||||
"plymouth-start.service" |
||||
"plymouth-quit.service" |
||||
"systemd-logind.service" |
||||
"getty@tty1.service" |
||||
]; |
||||
before = [ "graphical.target" ]; |
||||
wants = [ "dbus.socket" "systemd-logind.service" "plymouth-quit.service"]; |
||||
wantedBy = [ "graphical.target" ]; |
||||
conflicts = [ "getty@tty1.service" ]; |
||||
|
||||
restartIfChanged = false; |
||||
serviceConfig = { |
||||
ExecStart = '' |
||||
${pkgs.cage}/bin/cage \ |
||||
${escapeShellArgs cfg.extraArguments} \ |
||||
-- ${cfg.program} |
||||
''; |
||||
User = cfg.user; |
||||
|
||||
ConditionPathExists = "/dev/tty1"; |
||||
IgnoreSIGPIPE = "no"; |
||||
|
||||
# Log this user with utmp, letting it show up with commands 'w' and |
||||
# 'who'. This is needed since we replace (a)getty. |
||||
UtmpIdentifier = "%n"; |
||||
UtmpMode = "user"; |
||||
# A virtual terminal is needed. |
||||
TTYPath = "/dev/tty1"; |
||||
TTYReset = "yes"; |
||||
TTYVHangup = "yes"; |
||||
TTYVTDisallocate = "yes"; |
||||
# Fail to start if not controlling the virtual terminal. |
||||
StandardInput = "tty-fail"; |
||||
StandardOutput = "syslog"; |
||||
StandardError = "syslog"; |
||||
# Set up a full (custom) user session for the user, required by Cage. |
||||
PAMName = "cage"; |
||||
}; |
||||
}; |
||||
|
||||
security.pam.services.cage.text = '' |
||||
auth required pam_unix.so nullok |
||||
account required pam_unix.so |
||||
session required pam_unix.so |
||||
session required ${pkgs.systemd}/lib/security/pam_systemd.so |
||||
''; |
||||
|
||||
hardware.opengl.enable = mkDefault true; |
||||
|
||||
systemd.targets.graphical.wants = [ "cage-tty1.service" ]; |
||||
|
||||
systemd.defaultUnit = "graphical.target"; |
||||
}; |
||||
|
||||
meta.maintainers = with lib.maintainers; [ matthewbauer flokli ]; |
||||
|
||||
} |
@ -0,0 +1,43 @@ |
||||
import ./make-test-python.nix ({ pkgs, ...} : |
||||
|
||||
{ |
||||
name = "cage"; |
||||
meta = with pkgs.stdenv.lib.maintainers; { |
||||
maintainers = [ matthewbauer flokli ]; |
||||
}; |
||||
|
||||
machine = { ... }: |
||||
|
||||
{ |
||||
imports = [ ./common/user-account.nix ]; |
||||
services.cage = { |
||||
enable = true; |
||||
user = "alice"; |
||||
program = "${pkgs.xterm}/bin/xterm -cm -pc"; # disable color and bold to make OCR easier |
||||
}; |
||||
|
||||
# this needs a fairly recent kernel, otherwise: |
||||
# [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory |
||||
# [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory |
||||
# [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory |
||||
# [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory |
||||
# [backend/drm/drm.c:618] Failed to initialize renderer on connector 'Virtual-1': initial page-flip failed |
||||
# [backend/drm/drm.c:701] Failed to initialize renderer for plane |
||||
boot.kernelPackages = pkgs.linuxPackages_latest; |
||||
|
||||
virtualisation.memorySize = 1024; |
||||
}; |
||||
|
||||
enableOCR = true; |
||||
|
||||
testScript = { nodes, ... }: let |
||||
user = nodes.machine.config.users.users.alice; |
||||
in '' |
||||
with subtest("Wait for cage to boot up"): |
||||
start_all() |
||||
machine.wait_for_file("/run/user/${toString user.uid}/wayland-0.lock") |
||||
machine.wait_until_succeeds("pgrep xterm") |
||||
machine.wait_for_text("alice@machine") |
||||
machine.screenshot("screen") |
||||
''; |
||||
}) |
Loading…
Reference in new issue