3
0
Fork 0
forked from mirrors/nixpkgs
nixpkgs/nixos/modules/services/networking/pppd.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

155 lines
4.5 KiB
Nix
Raw Normal View History

2019-10-14 09:59:50 +01:00
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.pppd;
in
{
meta = {
maintainers = with maintainers; [ danderson ];
};
options = {
services.pppd = {
enable = mkEnableOption "pppd";
package = mkOption {
default = pkgs.ppp;
defaultText = literalExpression "pkgs.ppp";
2019-10-14 09:59:50 +01:00
type = types.package;
description = "pppd package to use.";
};
peers = mkOption {
default = {};
description = "pppd peers.";
2019-10-14 09:59:50 +01:00
type = types.attrsOf (types.submodule (
{ name, ... }:
{
options = {
name = mkOption {
type = types.str;
default = name;
example = "dialup";
description = "Name of the PPP peer.";
};
enable = mkOption {
type = types.bool;
default = true;
example = false;
description = "Whether to enable this PPP peer.";
};
autostart = mkOption {
type = types.bool;
default = true;
example = false;
description = "Whether the PPP session is automatically started at boot time.";
};
config = mkOption {
type = types.lines;
default = "";
description = "pppd configuration for this peer, see the pppd(8) man page.";
};
};
}));
};
};
};
config = let
enabledConfigs = filter (f: f.enable) (attrValues cfg.peers);
mkEtc = peerCfg: {
name = "ppp/peers/${peerCfg.name}";
value.text = peerCfg.config;
2019-10-14 09:59:50 +01:00
};
mkSystemd = peerCfg: {
name = "pppd-${peerCfg.name}";
value = {
2019-10-14 09:59:50 +01:00
restartTriggers = [ config.environment.etc."ppp/peers/${peerCfg.name}".source ];
before = [ "network.target" ];
wants = [ "network.target" ];
after = [ "network-pre.target" ];
environment = {
# pppd likes to write directly into /var/run. This is rude
# on a modern system, so we use libredirect to transparently
# move those files into /run/pppd.
LD_PRELOAD = "${pkgs.libredirect}/lib/libredirect.so";
NIX_REDIRECTS = "/var/run=/run/pppd";
};
serviceConfig = let
capabilities = [
"CAP_BPF"
"CAP_SYS_TTY_CONFIG"
"CAP_NET_ADMIN"
"CAP_NET_RAW"
];
in
{
2019-10-14 09:59:50 +01:00
ExecStart = "${getBin cfg.package}/sbin/pppd call ${peerCfg.name} nodetach nolog";
Restart = "always";
RestartSec = 5;
AmbientCapabilities = capabilities;
CapabilityBoundingSet = capabilities;
2019-10-14 09:59:50 +01:00
KeyringMode = "private";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateMounts = true;
PrivateTmp = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelModules = true;
# pppd can be configured to tweak kernel settings.
ProtectKernelTunables = false;
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_ATMPVC"
"AF_ATMSVC"
"AF_INET"
"AF_INET6"
"AF_IPX"
"AF_NETLINK"
"AF_PACKET"
"AF_PPPOX"
"AF_UNIX"
];
2019-10-14 09:59:50 +01:00
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SecureBits = "no-setuid-fixup-locked noroot-locked";
SystemCallFilter = "@system-service";
SystemCallArchitectures = "native";
# All pppd instances on a system must share a runtime
# directory in order for PPP multilink to work correctly. So
# we give all instances the same /run/pppd directory to store
# things in.
#
# For the same reason, we can't set PrivateUsers=true, because
# all instances need to run as the same user to access the
# multilink database.
RuntimeDirectory = "pppd";
RuntimeDirectoryPreserve = true;
};
wantedBy = mkIf peerCfg.autostart [ "multi-user.target" ];
};
};
etcFiles = listToAttrs (map mkEtc enabledConfigs);
systemdConfigs = listToAttrs (map mkSystemd enabledConfigs);
2019-10-14 09:59:50 +01:00
in mkIf cfg.enable {
2020-02-14 02:42:49 +00:00
environment.etc = etcFiles;
systemd.services = systemdConfigs;
2019-10-14 09:59:50 +01:00
};
}