commit 1f3f31b2a875e8f05ab97af1da2e7bb9c743a3ac · pyrox.dev/nixpkgs

+32
nixos/modules/services/misc/nix-daemon.nix
···

       47
       47
        
               ${optionalString cfg.requireSignedBinaryCaches ''

     

       48
       48
        
                 signed-binary-caches = *

     

       49
       49
        
               ''}

     

       50
       50
       +
               trusted-users = ${toString cfg.trustedUsers}

     

       51
       51
       +
               allowed-users = ${toString cfg.allowedUsers}

     

       50
       52
        
               $extraOptions

     

       51
       53
        
               END

     

       52
       54
        
             '';

     
···

       274
       276
        
                 if it is signed by <emphasis>any</emphasis> of the keys

     

       275
       277
        
                 listed here. By default, only the key for

     

       276
       278
        
                 <uri>cache.nixos.org</uri> is included.

     

       279
       279
       +
               '';

     

       280
       280
       +
             };

     

       281
       281
       +
       

     

       282
       282
       +
             trustedUsers = mkOption {

     

       283
       283
       +
               type = types.listOf types.str;

     

       284
       284
       +
               default = [ "root" ];

     

       285
       285
       +
               example = [ "root" "alice" "@wheel" ];

     

       286
       286
       +
               description = ''

     

       287
       287
       +
                 A list of names of users that have additional rights when

     

       288
       288
       +
                 connecting to the Nix daemon, such as the ability to specify

     

       289
       289
       +
                 additional binary caches, or to import unsigned NARs. You

     

       290
       290
       +
                 can also specify groups by prefixing them with

     

       291
       291
       +
                 <literal>@</literal>; for instance,

     

       292
       292
       +
                 <literal>@wheel</literal> means all users in the wheel

     

       293
       293
       +
                 group.

     

       294
       294
       +
               '';

     

       295
       295
       +
             };

     

       296
       296
       +
       

     

       297
       297
       +
             allowedUsers = mkOption {

     

       298
       298
       +
               type = types.listOf types.str;

     

       299
       299
       +
               default = [ "*" ];

     

       300
       300
       +
               example = [ "@wheel" "@builders" "alice" "bob" ];

     

       301
       301
       +
               description = ''

     

       302
       302
       +
                 A list of names of users (separated by whitespace) that are

     

       303
       303
       +
                 allowed to connect to the Nix daemon. As with

     

       304
       304
       +
                 <option>nix.trustedUsers</option>, you can specify groups by

     

       305
       305
       +
                 prefixing them with <literal>@</literal>. Also, you can

     

       306
       306
       +
                 allow all users by specifying <literal>*</literal>. The

     

       307
       307
       +
                 default is <literal>*</literal>. Note that trusted users are

     

       308
       308
       +
                 always allowed to connect.

     

       277
       309
        
               '';

     

       278
       310
        
             };

     

       279
       311