pyrox.dev
1# fwupd daemon.
2
3{ config, lib, pkgs, ... }:
4
5with lib;
6
7let
8 cfg = config.services.fwupd;
9
10 format = pkgs.formats.ini {
11 listToValue = l: lib.concatStringsSep ";" (map (s: generators.mkValueStringDefault {} s) l);
12 mkKeyValue = generators.mkKeyValueDefault {} "=";
13 };
14
15 customEtc = {
16 "fwupd/daemon.conf" = {
17 source = format.generate "daemon.conf" {
18 fwupd = cfg.daemonSettings;
19 };
20 };
21
22 "fwupd/uefi_capsule.conf" = {
23 source = format.generate "uefi_capsule.conf" {
24 uefi_capsule = cfg.uefiCapsuleSettings;
25 };
26 };
27 };
28
29 originalEtc =
30 let
31 mkEtcFile = n: nameValuePair n { source = "${cfg.package}/etc/${n}"; };
32 in listToAttrs (map mkEtcFile cfg.package.filesInstalledToEtc);
33 extraTrustedKeys =
34 let
35 mkName = p: "pki/fwupd/${baseNameOf (toString p)}";
36 mkEtcFile = p: nameValuePair (mkName p) { source = p; };
37 in listToAttrs (map mkEtcFile cfg.extraTrustedKeys);
38
39 enableRemote = base: remote: {
40 "fwupd/remotes.d/${remote}.conf" = {
41 source = pkgs.runCommand "${remote}-enabled.conf" {} ''
42 sed "s,^Enabled=false,Enabled=true," \
43 "${base}/etc/fwupd/remotes.d/${remote}.conf" > "$out"
44 '';
45 };
46 };
47 remotes = (foldl'
48 (configFiles: remote: configFiles // (enableRemote cfg.package remote))
49 {}
50 cfg.extraRemotes
51 ) // (
52 # We cannot include the file in $out and rely on filesInstalledToEtc
53 # to install it because it would create a cyclic dependency between
54 # the outputs. We also need to enable the remote,
55 # which should not be done by default.
56 if cfg.enableTestRemote then (enableRemote cfg.package.installedTests "fwupd-tests") else {}
57 );
58
59in {
60
61 ###### interface
62 options = {
63 services.fwupd = {
64 enable = mkOption {
65 type = types.bool;
66 default = false;
67 description = lib.mdDoc ''
68 Whether to enable fwupd, a DBus service that allows
69 applications to update firmware.
70 '';
71 };
72
73 extraTrustedKeys = mkOption {
74 type = types.listOf types.path;
75 default = [];
76 example = literalExpression "[ /etc/nixos/fwupd/myfirmware.pem ]";
77 description = lib.mdDoc ''
78 Installing a public key allows firmware signed with a matching private key to be recognized as trusted, which may require less authentication to install than for untrusted files. By default trusted firmware can be upgraded (but not downgraded) without the user or administrator password. Only very few keys are installed by default.
79 '';
80 };
81
82 extraRemotes = mkOption {
83 type = with types; listOf str;
84 default = [];
85 example = [ "lvfs-testing" ];
86 description = lib.mdDoc ''
87 Enables extra remotes in fwupd. See `/etc/fwupd/remotes.d`.
88 '';
89 };
90
91 enableTestRemote = mkOption {
92 type = types.bool;
93 default = false;
94 description = lib.mdDoc ''
95 Whether to enable test remote. This is used by
96 [installed tests](https://github.com/fwupd/fwupd/blob/master/data/installed-tests/README.md).
97 '';
98 };
99
100 package = mkOption {
101 type = types.package;
102 default = pkgs.fwupd;
103 defaultText = literalExpression "pkgs.fwupd";
104 description = lib.mdDoc ''
105 Which fwupd package to use.
106 '';
107 };
108
109 daemonSettings = mkOption {
110 type = types.submodule {
111 freeformType = format.type.nestedTypes.elemType;
112 options = {
113 DisabledDevices = mkOption {
114 type = types.listOf types.str;
115 default = [];
116 example = [ "2082b5e0-7a64-478a-b1b2-e3404fab6dad" ];
117 description = lib.mdDoc ''
118 List of device GUIDs to be disabled.
119 '';
120 };
121
122 DisabledPlugins = mkOption {
123 type = types.listOf types.str;
124 default = [];
125 example = [ "udev" ];
126 description = lib.mdDoc ''
127 List of plugins to be disabled.
128 '';
129 };
130
131 EspLocation = mkOption {
132 type = types.path;
133 default = config.boot.loader.efi.efiSysMountPoint;
134 defaultText = lib.literalExpression "config.boot.loader.efi.efiSysMountPoint";
135 description = lib.mdDoc ''
136 The EFI system partition (ESP) path used if UDisks is not available
137 or if this partition is not mounted at /boot/efi, /boot, or /efi
138 '';
139 };
140 };
141 };
142 default = {};
143 description = lib.mdDoc ''
144 Configurations for the fwupd daemon.
145 '';
146 };
147
148 uefiCapsuleSettings = mkOption {
149 type = types.submodule {
150 freeformType = format.type.nestedTypes.elemType;
151 };
152 default = {};
153 description = lib.mdDoc ''
154 UEFI capsule configurations for the fwupd daemon.
155 '';
156 };
157 };
158 };
159
160 imports = [
161 (mkRenamedOptionModule [ "services" "fwupd" "blacklistDevices"] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ])
162 (mkRenamedOptionModule [ "services" "fwupd" "blacklistPlugins"] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ])
163 (mkRenamedOptionModule [ "services" "fwupd" "disabledDevices" ] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ])
164 (mkRenamedOptionModule [ "services" "fwupd" "disabledPlugins" ] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ])
165 ];
166
167 ###### implementation
168 config = mkIf cfg.enable {
169 # Disable test related plug-ins implicitly so that users do not have to care about them.
170 services.fwupd.daemonSettings = {
171 DisabledPlugins = cfg.package.defaultDisabledPlugins;
172 EspLocation = config.boot.loader.efi.efiSysMountPoint;
173 };
174
175 environment.systemPackages = [ cfg.package ];
176
177 # customEtc overrides some files from the package
178 environment.etc = originalEtc // customEtc // extraTrustedKeys // remotes;
179
180 services.dbus.packages = [ cfg.package ];
181
182 services.udev.packages = [ cfg.package ];
183
184 # required to update the firmware of disks
185 services.udisks2.enable = true;
186
187 systemd.packages = [ cfg.package ];
188
189 security.polkit.enable = true;
190 };
191
192 meta = {
193 maintainers = pkgs.fwupd.meta.maintainers;
194 };
195}