about summary refs log tree commit diff
path: root/ops
diff options
context:
space:
mode:
authorVincent Ambo <mail@tazj.in>2022-04-09T09·40+0200
committerclbot <clbot@tvl.fyi>2022-04-14T16·18+0000
commite3cd8069ef8e810b494353bafa1d33aec3b3895e (patch)
tree2367cbef0f222199176ee46be8450bc831cd4b95 /ops
parent6ae0f53a409dc3b756fe2d9cda560468554a5ac5 (diff)
feat(ops/open_eid): Add script for setting up browser integration r/3948
Change-Id: Ib339d62d862fd99dab2fda30376b8e47b337a26b
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5441
Tested-by: BuildkiteCI
Reviewed-by: flokli <flokli@flokli.de>
Autosubmit: tazjin <tazjin@tvl.su>
Diffstat (limited to 'ops')
-rw-r--r--ops/modules/open_eid.nix18
1 files changed, 18 insertions, 0 deletions
diff --git a/ops/modules/open_eid.nix b/ops/modules/open_eid.nix
index 112e5827f52c..e3e686f3f62d 100644
--- a/ops/modules/open_eid.nix
+++ b/ops/modules/open_eid.nix
@@ -1,10 +1,28 @@
 # NixOS module to configure the Estonian e-ID software.
 { pkgs, ... }:
 
+let
+  # Wrapper script to add EID support to browsers. Each user needs to
+  # run this themselves, it does not work on a system level due to a
+  # bug in Chromium:
+  #
+  # https://bugs.chromium.org/p/chromium/issues/detail?id=16387
+  #
+  # This is based on the upstream setup script for Debian-derivatives:
+  # https://github.com/open-eid/linux-installer/blob/master/esteid-update-nssdb
+  setup-browser-eid = pkgs.writeShellScriptBin "setup-browser-eid" ''
+    NSSDB="''${HOME}/.pki/nssdb"
+    mkdir -p ''${NSSDB}
+
+    ${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add opensc-pkcs11 \
+      -libfile ${pkgs.opensc}/lib/onepin-opensc-pkcs11.so -mechanisms FRIENDLY
+  '';
+in
 {
   services.pcscd.enable = true;
 
   environment.systemPackages = with pkgs; [
     qdigidoc
+    setup-browser-eid
   ];
 }