···

       
47
       
 
       
    then [ "${name} ${value}" ]

     

       
48
       
 
       
    else concatLists (mapAttrsToList (genSection name) value);

     

       
49
       
 
       


     

       
50
       
-
       
  addDefaults = settings: { backend = "btrfs-progs-sudo"; } // settings;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
51
       
 
       


     

       
52
       
 
       
  mkConfigFile = name: settings: pkgs.writeTextFile {

     

       
53
       
 
       
    name = "btrbk-${name}.conf";

     
···

       
152
       
 
       
  };

     

       
153
       
 
       
  config = mkIf (sshEnabled || serviceEnabled) {

     

       
154
       
 
       
    environment.systemPackages = [ pkgs.btrbk ] ++ cfg.extraPackages;

     

       
155
       
-
       
    security.sudo.extraRules = [

     

       
156
       
-
       
      {

     

       
157
       
-
       
        users = [ "btrbk" ];

     

       
158
       
-
       
        commands = [

     

       
159
       
-
       
          { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       
160
       
-
       
          { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       
161
       
-
       
          { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       
162
       
-
       
          # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

     

       
163
       
-
       
          { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       
164
       
-
       
          { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       
165
       
-
       
          { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
166
       
 
       
        ];

     

       
167
       
-
       
      }

     

       
168
       
-
       
    ];

     

       
169
       
 
       
    users.users.btrbk = {

     

       
170
       
 
       
      isSystemUser = true;

     

       
171
       
 
       
      # ssh needs a home directory

     
···

       
183
       
 
       
              "best-effort" = 2;

     

       
184
       
 
       
              "realtime" = 1;

     

       
185
       
 
       
            }.${cfg.ioSchedulingClass};

     

       
0
       
 
       

     

       
186
       
 
       
          in

     

       
187
       
-
       
          ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh --sudo ${options}" ${v.key}''

     

       
188
       
 
       
        )

     

       
189
       
 
       
        cfg.sshAccess;

     

       
190
       
 
       
    };

     

···

       
47
       
 
       
    then [ "${name} ${value}" ]

     

       
48
       
 
       
    else concatLists (mapAttrsToList (genSection name) value);

     

       
49
       
 
       


     

       
50
       
+
       
  sudo_doas =

     

       
51
       
+
       
    if config.security.sudo.enable then "sudo"

     

       
52
       
+
       
    else if config.security.doas.enable then "doas"

     

       
53
       
+
       
    else throw "The btrbk nixos module needs either sudo or doas enabled in the configuration";

     

       
54
       
+
       


     

       
55
       
+
       
  addDefaults = settings: { backend = "btrfs-progs-${sudo_doas}"; } // settings;

     

       
56
       
 
       


     

       
57
       
 
       
  mkConfigFile = name: settings: pkgs.writeTextFile {

     

       
58
       
 
       
    name = "btrbk-${name}.conf";

     
···

       
157
       
 
       
  };

     

       
158
       
 
       
  config = mkIf (sshEnabled || serviceEnabled) {

     

       
159
       
 
       
    environment.systemPackages = [ pkgs.btrbk ] ++ cfg.extraPackages;

     

       
160
       
+
       
    security.sudo = mkIf (sudo_doas == "sudo") {

     

       
161
       
+
       
      extraRules = [

     

       
162
       
+
       
        {

     

       
163
       
+
       
            users = [ "btrbk" ];

     

       
164
       
+
       
            commands = [

     

       
165
       
+
       
            { command = "${pkgs.btrfs-progs}/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       
166
       
+
       
            { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       
167
       
+
       
            { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       
168
       
+
       
            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

     

       
169
       
+
       
            { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }

     

       
170
       
+
       
            { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }

     

       
171
       
+
       
            { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }

     

       
172
       
+
       
            ];

     

       
173
       
+
       
        }

     

       
174
       
+
       
      ];

     

       
175
       
+
       
    };

     

       
176
       
+
       
    security.doas = mkIf (sudo_doas == "doas") {

     

       
177
       
+
       
      extraRules = let

     

       
178
       
+
       
        doasCmdNoPass = cmd: { users = [ "btrbk" ]; cmd = cmd; noPass = true; };

     

       
179
       
+
       
      in

     

       
180
       
+
       
        [

     

       
181
       
+
       
            (doasCmdNoPass "${pkgs.btrfs-progs}/bin/btrfs")

     

       
182
       
+
       
            (doasCmdNoPass "${pkgs.coreutils}/bin/mkdir")

     

       
183
       
+
       
            (doasCmdNoPass "${pkgs.coreutils}/bin/readlink")

     

       
184
       
+
       
            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

     

       
185
       
+
       
            (doasCmdNoPass "/run/current-system/bin/btrfs")

     

       
186
       
+
       
            (doasCmdNoPass "/run/current-system/sw/bin/mkdir")

     

       
187
       
+
       
            (doasCmdNoPass "/run/current-system/sw/bin/readlink")

     

       
188
       
+
       


     

       
189
       
+
       
            # doas matches command, not binary

     

       
190
       
+
       
            (doasCmdNoPass "btrfs")

     

       
191
       
+
       
            (doasCmdNoPass "mkdir")

     

       
192
       
+
       
            (doasCmdNoPass "readlink")

     

       
193
       
 
       
        ];

     

       
194
       
+
       
    };

     

       
0
       
 
       

     

       
195
       
 
       
    users.users.btrbk = {

     

       
196
       
 
       
      isSystemUser = true;

     

       
197
       
 
       
      # ssh needs a home directory

     
···

       
209
       
 
       
              "best-effort" = 2;

     

       
210
       
 
       
              "realtime" = 1;

     

       
211
       
 
       
            }.${cfg.ioSchedulingClass};

     

       
212
       
+
       
            sudo_doas_flag = "--${sudo_doas}";

     

       
213
       
 
       
          in

     

       
214
       
+
       
          ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"} ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''

     

       
215
       
 
       
        )

     

       
216
       
 
       
        cfg.sshAccess;

     

       
217
       
 
       
    };