cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Merge pull request #273313 from Enzime/add/mosh-firewall-option

Browse source 
nixos/mosh: add `programs.mosh.openFirewall`
This commit is contained in:
Lin Jian 2023-12-16 12:24:42 -06:00 committed by GitHub
commit 174fc675c8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
nixos/modules/programs/mosh.nix
View file

@ -1,7 +1,5 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
with lib;
let let
cfg = config.programs.mosh; cfg = config.programs.mosh;
@ -9,28 +7,26 @@ let
in in
{ {
options.programs.mosh = { options.programs.mosh = {
enable = mkOption { enable = lib.mkEnableOption "mosh";
description = lib.mdDoc '' openFirewall = lib.mkEnableOption "" // {
Whether to enable mosh. Note, this will open ports in your firewall! description = "Whether to automatically open the necessary ports in the firewall.";
''; default = true;
default = false;
type = lib.types.bool;
}; };
withUtempter = mkOption { withUtempter = lib.mkEnableOption "" // {
description = lib.mdDoc '' description = lib.mdDoc ''
Whether to enable libutempter for mosh. Whether to enable libutempter for mosh.
This is required so that mosh can write to /var/run/utmp (which can be queried with `who` to display currently connected user sessions). This is required so that mosh can write to /var/run/utmp (which can be queried with `who` to display currently connected user sessions).
Note, this will add a guid wrapper for the group utmp! Note, this will add a guid wrapper for the group utmp!
''; '';
default = true; default = true;
type = lib.types.bool;
}; };
}; };
config = mkIf cfg.enable { config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; [ mosh ]; environment.systemPackages = [ pkgs.mosh ];
networking.firewall.allowedUDPPortRanges = [ { from = 60000; to = 61000; } ]; networking.firewall.allowedUDPPortRanges = lib.optional cfg.openFirewall { from = 60000; to = 61000; };
security.wrappers = mkIf cfg.withUtempter { security.wrappers = lib.mkIf cfg.withUtempter {
utempter = { utempter = {
source = "${pkgs.libutempter}/lib/utempter/utempter"; source = "${pkgs.libutempter}/lib/utempter/utempter";
owner = "root"; owner = "root";