pyrox.dev
1# Configuration for the Name Service Switch (/etc/nsswitch.conf).
2
3{ config, lib, pkgs, ... }:
4
5with lib;
6
7{
8 options = {
9
10 # NSS modules. Hacky!
11 # Only works with nscd!
12 system.nssModules = mkOption {
13 type = types.listOf types.path;
14 internal = true;
15 default = [ ];
16 description = ''
17 Search path for NSS (Name Service Switch) modules. This allows
18 several DNS resolution methods to be specified via
19 {file}`/etc/nsswitch.conf`.
20 '';
21 apply = list:
22 {
23 inherit list;
24 path = makeLibraryPath list;
25 };
26 };
27
28 system.nssDatabases = {
29 passwd = mkOption {
30 type = types.listOf types.str;
31 description = ''
32 List of passwd entries to configure in {file}`/etc/nsswitch.conf`.
33
34 Note that "files" is always prepended while "systemd" is appended if nscd is enabled.
35
36 This option only takes effect if nscd is enabled.
37 '';
38 default = [ ];
39 };
40
41 group = mkOption {
42 type = types.listOf types.str;
43 description = ''
44 List of group entries to configure in {file}`/etc/nsswitch.conf`.
45
46 Note that "files" is always prepended while "systemd" is appended if nscd is enabled.
47
48 This option only takes effect if nscd is enabled.
49 '';
50 default = [ ];
51 };
52
53 shadow = mkOption {
54 type = types.listOf types.str;
55 description = ''
56 List of shadow entries to configure in {file}`/etc/nsswitch.conf`.
57
58 Note that "files" is always prepended.
59
60 This option only takes effect if nscd is enabled.
61 '';
62 default = [ ];
63 };
64
65 sudoers = mkOption {
66 type = types.listOf types.str;
67 description = ''
68 List of sudoers entries to configure in {file}`/etc/nsswitch.conf`.
69
70 Note that "files" is always prepended.
71
72 This option only takes effect if nscd is enabled.
73 '';
74 default = [ ];
75 };
76
77 hosts = mkOption {
78 type = types.listOf types.str;
79 description = ''
80 List of hosts entries to configure in {file}`/etc/nsswitch.conf`.
81
82 Note that "files" is always prepended, and "dns" and "myhostname" are always appended.
83
84 This option only takes effect if nscd is enabled.
85 '';
86 default = [ ];
87 };
88
89 services = mkOption {
90 type = types.listOf types.str;
91 description = ''
92 List of services entries to configure in {file}`/etc/nsswitch.conf`.
93
94 Note that "files" is always prepended.
95
96 This option only takes effect if nscd is enabled.
97 '';
98 default = [ ];
99 };
100 };
101 };
102
103 imports = [
104 (mkRenamedOptionModule [ "system" "nssHosts" ] [ "system" "nssDatabases" "hosts" ])
105 ];
106
107 config = {
108 assertions = [
109 {
110 assertion = config.system.nssModules.path != "" -> config.services.nscd.enable;
111 message = ''
112 Loading NSS modules from system.nssModules (${config.system.nssModules.path}),
113 requires services.nscd.enable being set to true.
114
115 If disabling nscd is really necessary, it is possible to disable loading NSS modules
116 by setting `system.nssModules = lib.mkForce [];` in your configuration.nix.
117 '';
118 }
119 ];
120
121 # Name Service Switch configuration file. Required by the C
122 # library.
123 environment.etc."nsswitch.conf".text = ''
124 passwd: ${concatStringsSep " " config.system.nssDatabases.passwd}
125 group: ${concatStringsSep " " config.system.nssDatabases.group}
126 shadow: ${concatStringsSep " " config.system.nssDatabases.shadow}
127 sudoers: ${concatStringsSep " " config.system.nssDatabases.sudoers}
128
129 hosts: ${concatStringsSep " " config.system.nssDatabases.hosts}
130 networks: files
131
132 ethers: files
133 services: ${concatStringsSep " " config.system.nssDatabases.services}
134 protocols: files
135 rpc: files
136 '';
137
138 system.nssDatabases = {
139 passwd = mkBefore [ "files" ];
140 group = mkBefore [ "files" ];
141 shadow = mkBefore [ "files" ];
142 sudoers = mkBefore [ "files" ];
143 hosts = mkMerge [
144 (mkOrder 998 [ "files" ])
145 (mkOrder 1499 [ "dns" ])
146 ];
147 services = mkBefore [ "files" ];
148 };
149 };
150}