diff options
Diffstat (limited to 'ops/modules/open_eid.nix')
| -rw-r--r-- | ops/modules/open_eid.nix | 57 |
1 files changed, 37 insertions, 20 deletions
diff --git a/ops/modules/open_eid.nix b/ops/modules/open_eid.nix index a87acae47c0f..3a86e9e41690 100644 --- a/ops/modules/open_eid.nix +++ b/ops/modules/open_eid.nix @@ -1,25 +1,6 @@ # NixOS module to configure the Estonian e-ID software. { pkgs, ... }: -let - # Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load - # security devices. - # Each user needs to run this themselves, it does not work on a system level - # due to a bug in Chromium: - # - # https://bugs.chromium.org/p/chromium/issues/detail?id=16387 - # - # Firefox users can just set - # extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so"; - # when overriding the firefox derivation. - setup-browser-eid = pkgs.writeShellScriptBin "setup-browser-eid" '' - NSSDB="''${HOME}/.pki/nssdb" - mkdir -p ''${NSSDB} - - ${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \ - -libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so - ''; -in { services.pcscd.enable = true; @@ -29,9 +10,45 @@ in module: ${pkgs.opensc}/lib/opensc-pkcs11.so ''; + # Configure Firefox (in case users set `programs.firefox.enable = true;`) + programs.firefox = { + # Allow a possibly installed "Web eID" extension to do native messaging with + # the "web-eid-app" native component. + # Users not using `programs.firefox.enable` can override their firefox + # derivation, by setting `extraNativeMessagingHosts = [ pkgs.web-eid-app ]`. + nativeMessagingHosts.euwebid = true; + # Configure Firefox to load smartcards via p11kit-proxy. + # Users not using `programs.firefox.enable` can override their firefox + # derivation, by setting + # `extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so"`. + policies.SecurityDevices.p11-kit-proxy = "${pkgs.p11-kit}/lib/p11-kit-proxy.so"; + }; + + # Chromium users need a symlink to their (slightly different) .json file + # in the native messaging hosts' manifest file location. + environment.etc."chromium/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json"; + environment.etc."opt/chrome/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json"; + environment.systemPackages = with pkgs; [ libdigidocpp.bin # provides digidoc-tool(1) qdigidoc - setup-browser-eid + + # Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load + # security devices, so they can be used for TLS client auth. + # Each user needs to run this themselves, it does not work on a system level + # due to a bug in Chromium: + # + # https://bugs.chromium.org/p/chromium/issues/detail?id=16387 + # + # Firefox users can just set + # extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so"; + # when overriding the firefox derivation. + (pkgs.writeShellScriptBin "setup-browser-eid" '' + NSSDB="''${HOME}/.pki/nssdb" + mkdir -p ''${NSSDB} + + ${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \ + -libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so + '') ]; } |