pyrox.dev
1# fwupd daemon.
2{
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 cfg = config.services.fwupd;
10
11 format = pkgs.formats.ini {
12 listToValue = l: lib.concatStringsSep ";" (map (s: lib.generators.mkValueStringDefault { } s) l);
13 mkKeyValue = lib.generators.mkKeyValueDefault { } "=";
14 };
15
16 customEtc = {
17 "fwupd/fwupd.conf" = {
18 source = format.generate "fwupd.conf" (
19 {
20 fwupd = cfg.daemonSettings;
21 }
22 // lib.optionalAttrs (lib.length (lib.attrNames cfg.uefiCapsuleSettings) != 0) {
23 uefi_capsule = cfg.uefiCapsuleSettings;
24 }
25 );
26 # fwupd tries to chmod the file if it doesn't have the right permissions
27 mode = "0640";
28 };
29 };
30
31 originalEtc =
32 let
33 mkEtcFile = n: lib.nameValuePair n { source = "${cfg.package}/etc/${n}"; };
34 in
35 lib.listToAttrs (map mkEtcFile cfg.package.filesInstalledToEtc);
36 extraTrustedKeys =
37 let
38 mkName = p: "pki/fwupd/${baseNameOf (toString p)}";
39 mkEtcFile = p: lib.nameValuePair (mkName p) { source = p; };
40 in
41 lib.listToAttrs (map mkEtcFile cfg.extraTrustedKeys);
42
43 enableRemote = base: remote: {
44 "fwupd/remotes.d/${remote}.conf" = {
45 source = pkgs.runCommand "${remote}-enabled.conf" { } ''
46 sed "s,^Enabled=false,Enabled=true," \
47 "${base}/etc/fwupd/remotes.d/${remote}.conf" > "$out"
48 '';
49 };
50 };
51 remotes =
52 (lib.foldl' (
53 configFiles: remote: configFiles // (enableRemote cfg.package remote)
54 ) { } cfg.extraRemotes)
55 // (
56 # We cannot include the file in $out and rely on filesInstalledToEtc
57 # to install it because it would create a cyclic dependency between
58 # the outputs. We also need to enable the remote,
59 # which should not be done by default.
60 lib.optionalAttrs (cfg.daemonSettings.TestDevices or false) (
61 enableRemote cfg.package.installedTests "fwupd-tests"
62 )
63 );
64
65in
66{
67
68 ###### interface
69 options = {
70 services.fwupd = {
71 enable = lib.mkOption {
72 type = lib.types.bool;
73 default = false;
74 description = ''
75 Whether to enable fwupd, a DBus service that allows
76 applications to update firmware.
77 '';
78 };
79
80 extraTrustedKeys = lib.mkOption {
81 type = lib.types.listOf lib.types.path;
82 default = [ ];
83 example = lib.literalExpression "[ /etc/nixos/fwupd/myfirmware.pem ]";
84 description = ''
85 Installing a public key allows firmware signed with a matching private key to be recognized as trusted, which may require less authentication to install than for untrusted files. By default trusted firmware can be upgraded (but not downgraded) without the user or administrator password. Only very few keys are installed by default.
86 '';
87 };
88
89 extraRemotes = lib.mkOption {
90 type = with lib.types; listOf str;
91 default = [ ];
92 example = [ "lvfs-testing" ];
93 description = ''
94 Enables extra remotes in fwupd. See `/etc/fwupd/remotes.d`.
95 '';
96 };
97
98 package = lib.mkPackageOption pkgs "fwupd" { };
99
100 daemonSettings = lib.mkOption {
101 type = lib.types.submodule {
102 freeformType = format.type.nestedTypes.elemType;
103 options = {
104 DisabledDevices = lib.mkOption {
105 type = lib.types.listOf lib.types.str;
106 default = [ ];
107 example = [ "2082b5e0-7a64-478a-b1b2-e3404fab6dad" ];
108 description = ''
109 List of device GUIDs to be disabled.
110 '';
111 };
112
113 DisabledPlugins = lib.mkOption {
114 type = lib.types.listOf lib.types.str;
115 default = [ ];
116 example = [ "udev" ];
117 description = ''
118 List of plugins to be disabled.
119 '';
120 };
121
122 EspLocation = lib.mkOption {
123 type = lib.types.path;
124 default = config.boot.loader.efi.efiSysMountPoint;
125 defaultText = lib.literalExpression "config.boot.loader.efi.efiSysMountPoint";
126 description = ''
127 The EFI system partition (ESP) path used if UDisks is not available
128 or if this partition is not mounted at /boot/efi, /boot, or /efi
129 '';
130 };
131
132 TestDevices = lib.mkOption {
133 internal = true;
134 type = lib.types.bool;
135 default = false;
136 description = ''
137 Create virtual test devices and remote for validating daemon flows.
138 This is only intended for CI testing and development purposes.
139 '';
140 };
141 };
142 };
143 default = { };
144 description = ''
145 Configurations for the fwupd daemon.
146 '';
147 };
148
149 uefiCapsuleSettings = lib.mkOption {
150 type = lib.types.submodule {
151 freeformType = format.type.nestedTypes.elemType;
152 };
153 default = { };
154 description = ''
155 UEFI capsule configurations for the fwupd daemon.
156 '';
157 };
158 };
159 };
160
161 imports = [
162 (lib.mkRenamedOptionModule
163 [ "services" "fwupd" "blacklistDevices" ]
164 [ "services" "fwupd" "daemonSettings" "DisabledDevices" ]
165 )
166 (lib.mkRenamedOptionModule
167 [ "services" "fwupd" "blacklistPlugins" ]
168 [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ]
169 )
170 (lib.mkRenamedOptionModule
171 [ "services" "fwupd" "disabledDevices" ]
172 [ "services" "fwupd" "daemonSettings" "DisabledDevices" ]
173 )
174 (lib.mkRenamedOptionModule
175 [ "services" "fwupd" "disabledPlugins" ]
176 [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ]
177 )
178 (lib.mkRemovedOptionModule [ "services" "fwupd" "enableTestRemote" ]
179 "This option was removed after being removed upstream. It only provided a method for testing fwupd functionality, and should not have been exposed for use outside of nix tests."
180 )
181 ];
182
183 ###### implementation
184 config = lib.mkIf cfg.enable {
185 # Disable test related plug-ins implicitly so that users do not have to care about them.
186 services.fwupd.daemonSettings = {
187 EspLocation = config.boot.loader.efi.efiSysMountPoint;
188 };
189
190 environment.systemPackages = [ cfg.package ];
191
192 # customEtc overrides some files from the package
193 environment.etc = originalEtc // customEtc // extraTrustedKeys // remotes;
194
195 services.dbus.packages = [ cfg.package ];
196
197 services.udev.packages = [ cfg.package ];
198
199 # required to update the firmware of disks
200 services.udisks2.enable = true;
201
202 systemd = {
203 packages = [ cfg.package ];
204
205 # fwupd-refresh expects a user that we do not create, so just run with DynamicUser
206 # instead and ensure we take ownership of /var/lib/fwupd
207 services.fwupd-refresh.serviceConfig = {
208 StateDirectory = "fwupd";
209 # Better for debugging, upstream sets stderr to null for some reason..
210 StandardError = "inherit";
211 };
212
213 timers.fwupd-refresh.wantedBy = [ "timers.target" ];
214 };
215
216 users.users.fwupd-refresh = {
217 isSystemUser = true;
218 group = "fwupd-refresh";
219 };
220 users.groups.fwupd-refresh = { };
221
222 security.polkit.enable = true;
223 };
224
225 meta = {
226 maintainers = pkgs.fwupd.meta.maintainers;
227 };
228}