2 description = "Open source ARC implementation";
5 url = "path:../myuids";
7 inputs.flake-utils.url = "github:numtide/flake-utils";
8 inputs.nixpkgs.url = "github:NixOS/nixpkgs";
10 url = "github:trusteddomainproject/OpenARC";
14 outputs = { self, myuids, openarc, flake-utils, nixpkgs }: flake-utils.lib.eachDefaultSystem (system:
16 pkgs = import nixpkgs { inherit system; overlays = []; };
18 packages.openarc = pkgs.callPackage ./. { src = openarc; };
19 defaultPackage = packages.openarc;
20 legacyPackages.openarc = packages.openarc;
21 apps.openarc = flake-utils.lib.mkApp { drv = packages.openarc; };
22 defaultApp = apps.openarc;
25 build = defaultPackage;
26 } // pkgs.lib.optionalAttrs (builtins.elem system pkgs.lib.systems.doubles.linux) {
28 let testing = import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; };
31 server = { pkgs, ... }: {
32 imports = [ self.nixosModule ];
33 config.services.openarc.enable = true;
34 config.services.openarc.configFile = pkgs.writeText "openarc.conf" ''
35 Domain foo.example.org
36 KeyFile /etc/openarc/foo.key
43 server.wait_until_fails("openarc.service")
44 server.execute("install -m 0700 -o openarc -g openarc -d /etc/openarc")
45 server.execute("echo some_key > /etc/openarc/foo.key")
46 server.execute("chown openarc:openarc /etc/openarc/foo.key")
47 server.execute("chmod 400 /etc/openarc/foo.key")
48 server.systemctl("restart openarc")
49 server.wait_for_unit("openarc.service")
50 server.succeed("[ -S /run/openarc/openarc.sock ]")
56 openarc = final: prev: {
57 openarc = self.defaultPackage."${final.system}";
60 overlay = overlays.openarc;
61 nixosModule = { config, lib, pkgs, ... }:
63 cfg = config.services.openarc;
64 defaultSock = "/run/openarc/openarc.sock";
65 args = [ "-f" "-p" "local:${cfg.socket}" ] ++ lib.optionals (cfg.configFile != null) [ "-c" cfg.configFile ];
67 # Necessary for situations where flake gets included multiple times
68 key = builtins.hashString "sha256" (builtins.path { path = self.sourceInfo.outPath; name = "source"; });
71 enable = lib.mkOption {
72 type = lib.types.bool;
74 description = "Whether to enable the OpenARC sender authentication system.";
77 socket = lib.mkOption {
79 default = defaultSock;
80 description = "Socket which is used for communication with OpenARC.";
86 description = "User for the daemon.";
89 group = lib.mkOption {
92 description = "Group for the daemon.";
95 configFile = lib.mkOption {
96 type = lib.types.nullOr lib.types.path;
98 description = "Additional OpenARC configuration.";
104 config = lib.mkIf cfg.enable {
105 nixpkgs.overlays = [ self.overlay ];
106 users.users = lib.optionalAttrs (cfg.user == "openarc") {
109 uid = myuids.lib.uids.openarc;
113 users.groups = lib.optionalAttrs (cfg.group == "openarc") {
114 openarc.gid = myuids.lib.gids.openarc;
117 environment.systemPackages = [ pkgs.openarc ];
119 systemd.services.openarc = {
120 description = "OpenARC daemon";
121 after = [ "network.target" ];
122 wantedBy = [ "multi-user.target" ];
125 ExecStart = "${self.defaultApp."${pkgs.system}".program} ${lib.escapeShellArgs args}";
128 RuntimeDirectory = lib.optional (cfg.socket == defaultSock) "openarc";
129 PermissionsStartOnly = true;