pyrox.dev
1# fwupd daemon.
2
3{ config, lib, pkgs, ... }:
4
5with lib;
6
7let
8 cfg = config.services.fwupd;
9
10 format = pkgs.formats.ini {
11 listToValue = l: lib.concatStringsSep ";" (map (s: generators.mkValueStringDefault {} s) l);
12 mkKeyValue = generators.mkKeyValueDefault {} "=";
13 };
14
15 customEtc = {
16 "fwupd/fwupd.conf" = {
17 source = format.generate "fwupd.conf" ({
18 fwupd = cfg.daemonSettings;
19 } // lib.optionalAttrs (lib.length (lib.attrNames cfg.uefiCapsuleSettings) != 0) {
20 uefi_capsule = cfg.uefiCapsuleSettings;
21 });
22 # fwupd tries to chmod the file if it doesn't have the right permissions
23 mode = "0640";
24 };
25 };
26
27 originalEtc =
28 let
29 mkEtcFile = n: nameValuePair n { source = "${cfg.package}/etc/${n}"; };
30 in listToAttrs (map mkEtcFile cfg.package.filesInstalledToEtc);
31 extraTrustedKeys =
32 let
33 mkName = p: "pki/fwupd/${baseNameOf (toString p)}";
34 mkEtcFile = p: nameValuePair (mkName p) { source = p; };
35 in listToAttrs (map mkEtcFile cfg.extraTrustedKeys);
36
37 enableRemote = base: remote: {
38 "fwupd/remotes.d/${remote}.conf" = {
39 source = pkgs.runCommand "${remote}-enabled.conf" {} ''
40 sed "s,^Enabled=false,Enabled=true," \
41 "${base}/etc/fwupd/remotes.d/${remote}.conf" > "$out"
42 '';
43 };
44 };
45 remotes = (foldl'
46 (configFiles: remote: configFiles // (enableRemote cfg.package remote))
47 {}
48 cfg.extraRemotes
49 ) // (
50 # We cannot include the file in $out and rely on filesInstalledToEtc
51 # to install it because it would create a cyclic dependency between
52 # the outputs. We also need to enable the remote,
53 # which should not be done by default.
54 lib.optionalAttrs
55 (cfg.daemonSettings.TestDevices or false)
56 (enableRemote cfg.package.installedTests "fwupd-tests")
57 );
58
59in {
60
61 ###### interface
62 options = {
63 services.fwupd = {
64 enable = mkOption {
65 type = types.bool;
66 default = false;
67 description = ''
68 Whether to enable fwupd, a DBus service that allows
69 applications to update firmware.
70 '';
71 };
72
73 extraTrustedKeys = mkOption {
74 type = types.listOf types.path;
75 default = [];
76 example = literalExpression "[ /etc/nixos/fwupd/myfirmware.pem ]";
77 description = ''
78 Installing a public key allows firmware signed with a matching private key to be recognized as trusted, which may require less authentication to install than for untrusted files. By default trusted firmware can be upgraded (but not downgraded) without the user or administrator password. Only very few keys are installed by default.
79 '';
80 };
81
82 extraRemotes = mkOption {
83 type = with types; listOf str;
84 default = [];
85 example = [ "lvfs-testing" ];
86 description = ''
87 Enables extra remotes in fwupd. See `/etc/fwupd/remotes.d`.
88 '';
89 };
90
91 package = mkPackageOption pkgs "fwupd" { };
92
93 daemonSettings = mkOption {
94 type = types.submodule {
95 freeformType = format.type.nestedTypes.elemType;
96 options = {
97 DisabledDevices = mkOption {
98 type = types.listOf types.str;
99 default = [];
100 example = [ "2082b5e0-7a64-478a-b1b2-e3404fab6dad" ];
101 description = ''
102 List of device GUIDs to be disabled.
103 '';
104 };
105
106 DisabledPlugins = mkOption {
107 type = types.listOf types.str;
108 default = [];
109 example = [ "udev" ];
110 description = ''
111 List of plugins to be disabled.
112 '';
113 };
114
115 EspLocation = mkOption {
116 type = types.path;
117 default = config.boot.loader.efi.efiSysMountPoint;
118 defaultText = lib.literalExpression "config.boot.loader.efi.efiSysMountPoint";
119 description = ''
120 The EFI system partition (ESP) path used if UDisks is not available
121 or if this partition is not mounted at /boot/efi, /boot, or /efi
122 '';
123 };
124
125 TestDevices = mkOption {
126 internal = true;
127 type = types.bool;
128 default = false;
129 description = ''
130 Create virtual test devices and remote for validating daemon flows.
131 This is only intended for CI testing and development purposes.
132 '';
133 };
134 };
135 };
136 default = {};
137 description = ''
138 Configurations for the fwupd daemon.
139 '';
140 };
141
142 uefiCapsuleSettings = mkOption {
143 type = types.submodule {
144 freeformType = format.type.nestedTypes.elemType;
145 };
146 default = {};
147 description = ''
148 UEFI capsule configurations for the fwupd daemon.
149 '';
150 };
151 };
152 };
153
154 imports = [
155 (mkRenamedOptionModule [ "services" "fwupd" "blacklistDevices"] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ])
156 (mkRenamedOptionModule [ "services" "fwupd" "blacklistPlugins"] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ])
157 (mkRenamedOptionModule [ "services" "fwupd" "disabledDevices" ] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ])
158 (mkRenamedOptionModule [ "services" "fwupd" "disabledPlugins" ] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ])
159 (mkRemovedOptionModule [ "services" "fwupd" "enableTestRemote" ] "This option was removed after being removed upstream. It only provided a method for testing fwupd functionality, and should not have been exposed for use outside of nix tests.")
160 ];
161
162 ###### implementation
163 config = mkIf cfg.enable {
164 # Disable test related plug-ins implicitly so that users do not have to care about them.
165 services.fwupd.daemonSettings = {
166 EspLocation = config.boot.loader.efi.efiSysMountPoint;
167 };
168
169 environment.systemPackages = [ cfg.package ];
170
171 # customEtc overrides some files from the package
172 environment.etc = originalEtc // customEtc // extraTrustedKeys // remotes;
173
174 services.dbus.packages = [ cfg.package ];
175
176 services.udev.packages = [ cfg.package ];
177
178 # required to update the firmware of disks
179 services.udisks2.enable = true;
180
181 systemd = {
182 packages = [ cfg.package ];
183
184 # fwupd-refresh expects a user that we do not create, so just run with DynamicUser
185 # instead and ensure we take ownership of /var/lib/fwupd
186 services.fwupd-refresh.serviceConfig = {
187 StateDirectory = "fwupd";
188 # Better for debugging, upstream sets stderr to null for some reason..
189 StandardError = "inherit";
190 };
191
192 timers.fwupd-refresh.wantedBy = [ "timers.target" ];
193 };
194
195 users.users.fwupd-refresh = {
196 isSystemUser = true;
197 group = "fwupd-refresh";
198 };
199 users.groups.fwupd-refresh = {};
200
201 security.polkit.enable = true;
202 };
203
204 meta = {
205 maintainers = pkgs.fwupd.meta.maintainers;
206 };
207}