pyrox.dev
1{ config, pkgs, lib, ... }:
2
3with lib;
4
5let
6 cfg = config.services.cage;
7in {
8 options.services.cage.enable = mkEnableOption "cage kiosk service";
9
10 options.services.cage.user = mkOption {
11 type = types.str;
12 default = "demo";
13 description = ''
14 User to log-in as.
15 '';
16 };
17
18 options.services.cage.extraArguments = mkOption {
19 type = types.listOf types.str;
20 default = [];
21 defaultText = literalExpression "[]";
22 description = "Additional command line arguments to pass to Cage.";
23 example = ["-d"];
24 };
25
26 options.services.cage.program = mkOption {
27 type = types.path;
28 default = "${pkgs.xterm}/bin/xterm";
29 defaultText = literalExpression ''"''${pkgs.xterm}/bin/xterm"'';
30 description = ''
31 Program to run in cage.
32 '';
33 };
34
35 config = mkIf cfg.enable {
36
37 # The service is partially based off of the one provided in the
38 # cage wiki at
39 # https://github.com/Hjdskes/cage/wiki/Starting-Cage-on-boot-with-systemd.
40 systemd.services."cage-tty1" = {
41 enable = true;
42 after = [
43 "systemd-user-sessions.service"
44 "plymouth-start.service"
45 "plymouth-quit.service"
46 "systemd-logind.service"
47 "getty@tty1.service"
48 ];
49 before = [ "graphical.target" ];
50 wants = [ "dbus.socket" "systemd-logind.service" "plymouth-quit.service"];
51 wantedBy = [ "graphical.target" ];
52 conflicts = [ "getty@tty1.service" ];
53
54 restartIfChanged = false;
55 unitConfig.ConditionPathExists = "/dev/tty1";
56 serviceConfig = {
57 ExecStart = ''
58 ${pkgs.cage}/bin/cage \
59 ${escapeShellArgs cfg.extraArguments} \
60 -- ${cfg.program}
61 '';
62 User = cfg.user;
63
64 IgnoreSIGPIPE = "no";
65
66 # Log this user with utmp, letting it show up with commands 'w' and
67 # 'who'. This is needed since we replace (a)getty.
68 UtmpIdentifier = "%n";
69 UtmpMode = "user";
70 # A virtual terminal is needed.
71 TTYPath = "/dev/tty1";
72 TTYReset = "yes";
73 TTYVHangup = "yes";
74 TTYVTDisallocate = "yes";
75 # Fail to start if not controlling the virtual terminal.
76 StandardInput = "tty-fail";
77 # Set up a full (custom) user session for the user, required by Cage.
78 PAMName = "cage";
79 };
80 };
81
82 security.pam.services.cage.text = ''
83 auth required pam_unix.so nullok
84 account required pam_unix.so
85 session required pam_unix.so
86 session required pam_env.so conffile=/etc/pam/environment readenv=0
87 session required ${pkgs.systemd}/lib/security/pam_systemd.so
88 '';
89
90 hardware.opengl.enable = mkDefault true;
91
92 systemd.targets.graphical.wants = [ "cage-tty1.service" ];
93
94 systemd.defaultUnit = "graphical.target";
95 };
96
97 meta.maintainers = with lib.maintainers; [ matthewbauer ];
98
99}