modules/private/pub/default.nix

   1 { lib, pkgs, config,  ... }:
   2 {
   3   options = {
   4     myServices.pub.enable = lib.mkOption {
   5       type = lib.types.bool;
   6       default = false;
   7       description = ''
   8         Whether to enable pub user.
   9       '';
  10     };
  11   };
  12
  13   config = lib.mkIf config.myServices.pub.enable {
  14     myServices.ssh.modules = [{
  15       snippet = builtins.readFile ./ldap_pub.sh;
  16       dependencies = [ pkgs.coreutils ];
  17     }];
  18     users.users.pub = let
  19       restrict = pkgs.runCommand "restrict" {
  20         file = ./restrict;
  21         buildInputs = [ pkgs.makeWrapper ];
  22       } ''
  23         mkdir -p $out/bin
  24         cp $file $out/bin/restrict
  25         chmod a+x $out/bin/restrict
  26         patchShebangs $out/bin/restrict
  27         wrapProgram $out/bin/restrict \
  28           --prefix PATH : ${lib.makeBinPath [ pkgs.bubblewrap pkgs.rrsync ]} \
  29           --set TMUX_RESTRICT ${./tmux.restrict.conf}
  30       '';
  31       purple-hangouts = pkgs.purple-hangouts.overrideAttrs(old: {
  32         installPhase = ''
  33           install -Dm755 -t $out/lib/purple-2/ libhangouts.so
  34           for size in 16 22 24 48; do
  35             install -TDm644 hangouts$size.png $out/share/pixmaps/pidgin/protocols/$size/hangouts.png
  36           done
  37           '';
  38       });
  39     in {
  40       createHome = true;
  41       description = "Restricted shell user";
  42       home = "/var/lib/pub";
  43       uid = config.myEnv.users.pub.uid;
  44       isNormalUser = true;
  45       group = "nogroup";
  46       useDefaultShell = true;
  47       packages = [
  48         restrict
  49         pkgs.tmux
  50         (pkgs.pidgin.override { plugins = [
  51           pkgs.purple-plugin-pack purple-hangouts
  52           pkgs.purple-discord pkgs.purple-facebook
  53           pkgs.telegram-purple
  54         ]; })
  55         ];
  56     };
  57   };
  58 }