blob: fa577f0f57228a658a9d88f987db29bafbb29406 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
# NixOS module to configure the Estonian e-ID software.
{ pkgs, ... }:
{
services.pcscd.enable = true;
# Tell p11-kit to load/proxy opensc-pkcs11.so, providing all available slots
# (PIN1 for authentication/decryption, PIN2 for signing).
environment.etc."pkcs11/modules/opensc-pkcs11".text = ''
module: ${pkgs.opensc}/lib/opensc-pkcs11.so
'';
# Configure Firefox (in case users set `programs.firefox.enable = true;`)
programs.firefox = {
# Allow a possibly installed "Web eID" extension to do native messaging with
# the "web-eid-app" native component.
# Users not using `programs.firefox.enable` can override their firefox
# derivation, by setting `extraNativeMessagingHosts = [ pkgs.web-eid-app ]`.
nativeMessagingHosts.packages = [ pkgs.web-eid-app ];
# Configure Firefox to load smartcards via p11kit-proxy.
# Users not using `programs.firefox.enable` can override their firefox
# derivation, by setting
# `extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so"`.
policies.SecurityDevices.p11-kit-proxy = "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
};
# Chromium users need a symlink to their (slightly different) .json file
# in the native messaging hosts' manifest file location.
environment.etc."chromium/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json";
environment.etc."opt/chrome/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json";
environment.systemPackages = with pkgs; [
libdigidocpp.bin # provides digidoc-tool(1)
qdigidoc
# Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load
# security devices, so they can be used for TLS client auth.
# Each user needs to run this themselves, it does not work on a system level
# due to a bug in Chromium:
#
# https://bugs.chromium.org/p/chromium/issues/detail?id=16387
#
# Firefox users can just set
# extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
# when overriding the firefox derivation.
(pkgs.writeShellScriptBin "setup-browser-eid" ''
NSSDB="''${HOME}/.pki/nssdb"
mkdir -p ''${NSSDB}
${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \
-libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so
'')
];
}
|
