pyrox.dev
1{ config, lib, pkgs, ... }:
2
3let
4 inherit (lib) mkEnableOption mkIf mkOption types;
5
6 generic = variant:
7 let
8 cfg = config.services.${variant};
9 pkg = pkgs.${variant};
10 birdBin = if variant == "bird6" then "bird6" else "bird";
11 birdc = if variant == "bird6" then "birdc6" else "birdc";
12 descr =
13 { bird = "1.9.x with IPv4 suport";
14 bird6 = "1.9.x with IPv6 suport";
15 bird2 = "2.x";
16 }.${variant};
17 configFile = pkgs.stdenv.mkDerivation {
18 name = "${variant}.conf";
19 text = cfg.config;
20 preferLocalBuild = true;
21 buildCommand = ''
22 echo -n "$text" > $out
23 ${pkg}/bin/${birdBin} -d -p -c $out
24 '';
25 };
26 in {
27 ###### interface
28 options = {
29 services.${variant} = {
30 enable = mkEnableOption "BIRD Internet Routing Daemon (${descr})";
31 config = mkOption {
32 type = types.lines;
33 description = ''
34 BIRD Internet Routing Daemon configuration file.
35 <link xlink:href='http://bird.network.cz/'/>
36 '';
37 };
38 };
39 };
40
41 ###### implementation
42 config = mkIf cfg.enable {
43 environment.systemPackages = [ pkg ];
44 systemd.services.${variant} = {
45 description = "BIRD Internet Routing Daemon (${descr})";
46 wantedBy = [ "multi-user.target" ];
47 serviceConfig = {
48 Type = "forking";
49 Restart = "on-failure";
50 ExecStart = "${pkg}/bin/${birdBin} -c ${configFile} -u ${variant} -g ${variant}";
51 ExecReload = "${pkg}/bin/${birdc} configure";
52 ExecStop = "${pkg}/bin/${birdc} down";
53 CapabilityBoundingSet = [ "CAP_CHOWN" "CAP_FOWNER" "CAP_DAC_OVERRIDE" "CAP_SETUID" "CAP_SETGID"
54 # see bird/sysdep/linux/syspriv.h
55 "CAP_NET_BIND_SERVICE" "CAP_NET_BROADCAST" "CAP_NET_ADMIN" "CAP_NET_RAW" ];
56 ProtectSystem = "full";
57 ProtectHome = "yes";
58 SystemCallFilter="~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io";
59 MemoryDenyWriteExecute = "yes";
60 };
61 };
62 users = {
63 extraUsers.${variant} = {
64 description = "BIRD Internet Routing Daemon user";
65 group = variant;
66 };
67 extraGroups.${variant} = {};
68 };
69 };
70 };
71
72in
73
74{
75 imports = map generic [ "bird" "bird6" "bird2" ];
76}