pyrox.dev
1# Configuration for the Name Service Switch (/etc/nsswitch.conf).
2
3{ config, lib, pkgs, ... }:
4
5with lib;
6
7{
8 options = {
9
10 # NSS modules. Hacky!
11 # Only works with nscd!
12 system.nssModules = mkOption {
13 type = types.listOf types.path;
14 internal = true;
15 default = [];
16 description = ''
17 Search path for NSS (Name Service Switch) modules. This allows
18 several DNS resolution methods to be specified via
19 <filename>/etc/nsswitch.conf</filename>.
20 '';
21 apply = list:
22 {
23 inherit list;
24 path = makeLibraryPath list;
25 };
26 };
27
28 system.nssDatabases = {
29 passwd = mkOption {
30 type = types.listOf types.str;
31 description = ''
32 List of passwd entries to configure in <filename>/etc/nsswitch.conf</filename>.
33
34 Note that "files" is always prepended while "systemd" is appended if nscd is enabled.
35
36 This option only takes effect if nscd is enabled.
37 '';
38 default = [];
39 };
40
41 group = mkOption {
42 type = types.listOf types.str;
43 description = ''
44 List of group entries to configure in <filename>/etc/nsswitch.conf</filename>.
45
46 Note that "files" is always prepended while "systemd" is appended if nscd is enabled.
47
48 This option only takes effect if nscd is enabled.
49 '';
50 default = [];
51 };
52
53 shadow = mkOption {
54 type = types.listOf types.str;
55 description = ''
56 List of shadow entries to configure in <filename>/etc/nsswitch.conf</filename>.
57
58 Note that "files" is always prepended.
59
60 This option only takes effect if nscd is enabled.
61 '';
62 default = [];
63 };
64
65 hosts = mkOption {
66 type = types.listOf types.str;
67 description = ''
68 List of hosts entries to configure in <filename>/etc/nsswitch.conf</filename>.
69
70 Note that "files" is always prepended, and "dns" and "myhostname" are always appended.
71
72 This option only takes effect if nscd is enabled.
73 '';
74 default = [];
75 };
76
77 services = mkOption {
78 type = types.listOf types.str;
79 description = ''
80 List of services entries to configure in <filename>/etc/nsswitch.conf</filename>.
81
82 Note that "files" is always prepended.
83
84 This option only takes effect if nscd is enabled.
85 '';
86 default = [];
87 };
88 };
89 };
90
91 imports = [
92 (mkRenamedOptionModule [ "system" "nssHosts" ] [ "system" "nssDatabases" "hosts" ])
93 ];
94
95 config = {
96 assertions = [
97 {
98 # Prevent users from disabling nscd, with nssModules being set.
99 # If disabling nscd is really necessary, it's still possible to opt out
100 # by forcing config.system.nssModules to [].
101 assertion = config.system.nssModules.path != "" -> config.services.nscd.enable;
102 message = "Loading NSS modules from system.nssModules (${config.system.nssModules.path}), requires services.nscd.enable being set to true.";
103 }
104 ];
105
106 # Name Service Switch configuration file. Required by the C
107 # library.
108 environment.etc."nsswitch.conf".text = ''
109 passwd: ${concatStringsSep " " config.system.nssDatabases.passwd}
110 group: ${concatStringsSep " " config.system.nssDatabases.group}
111 shadow: ${concatStringsSep " " config.system.nssDatabases.shadow}
112
113 hosts: ${concatStringsSep " " config.system.nssDatabases.hosts}
114 networks: files
115
116 ethers: files
117 services: ${concatStringsSep " " config.system.nssDatabases.services}
118 protocols: files
119 rpc: files
120 '';
121
122 system.nssDatabases = {
123 passwd = mkBefore [ "files" ];
124 group = mkBefore [ "files" ];
125 shadow = mkBefore [ "files" ];
126 hosts = mkMerge [
127 (mkOrder 998 [ "files" ])
128 (mkOrder 1499 [ "dns" ])
129 ];
130 services = mkBefore [ "files" ];
131 };
132 };
133}