81 lines
2.2 KiB
Nix
81 lines
2.2 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
...
|
|
}: let
|
|
inherit
|
|
(lib)
|
|
concatLists
|
|
flip
|
|
mapAttrsToList
|
|
mkDefault
|
|
mdDoc
|
|
mkIf
|
|
mkOption
|
|
types
|
|
;
|
|
|
|
cfg = config.users.deterministicIds;
|
|
in {
|
|
options = {
|
|
users.deterministicIds = mkOption {
|
|
default = {};
|
|
description = mdDoc ''
|
|
Maps a user or group name to its expected uid/gid values. If a user/group is
|
|
used on the system without specifying a uid/gid, this module will assign the
|
|
corresponding ids defined here, or show an error if the definition is missing.
|
|
'';
|
|
type = types.attrsOf (types.submodule {
|
|
options = {
|
|
uid = mkOption {
|
|
type = types.nullOr types.int;
|
|
default = null;
|
|
description = mdDoc "The uid to assign if it is missing in `users.users.<name>`.";
|
|
};
|
|
gid = mkOption {
|
|
type = types.nullOr types.int;
|
|
default = null;
|
|
description = mdDoc "The gid to assign if it is missing in `users.groups.<name>`.";
|
|
};
|
|
};
|
|
});
|
|
};
|
|
|
|
users.users = mkOption {
|
|
type = types.attrsOf (types.submodule ({name, ...}: {
|
|
config.uid = let
|
|
deterministicUid = cfg.${name}.uid or null;
|
|
in
|
|
mkIf (deterministicUid != null) (mkDefault deterministicUid);
|
|
}));
|
|
};
|
|
|
|
users.groups = mkOption {
|
|
type = types.attrsOf (types.submodule ({name, ...}: {
|
|
config.gid = let
|
|
deterministicGid = cfg.${name}.gid or null;
|
|
in
|
|
mkIf (deterministicGid != null) (mkDefault deterministicGid);
|
|
}));
|
|
};
|
|
};
|
|
|
|
config = {
|
|
assertions =
|
|
concatLists (flip mapAttrsToList config.users.users (name: user: [
|
|
{
|
|
assertion = user.uid != null;
|
|
message = "non-deterministic uid detected for '${name}', please assign one via `users.deterministicIds`";
|
|
}
|
|
{
|
|
assertion = !user.autoSubUidGidRange;
|
|
message = "non-deterministic subUids/subGids detected for: ${name}";
|
|
}
|
|
]))
|
|
++ flip mapAttrsToList config.users.groups (name: group: {
|
|
assertion = group.gid != null;
|
|
message = "non-deterministic gid detected for '${name}', please assign one via `users.deterministicIds`";
|
|
});
|
|
};
|
|
}
|