From 1faa8d9acff1857537d3fb35768de2ede64e6b36 Mon Sep 17 00:00:00 2001 From: Bruno BELANYI Date: Thu, 14 Dec 2023 11:10:14 +0000 Subject: [PATCH] nixos: services: wireguard: add 'simpleManagement' This makes it easier to manage the VPN services, as they don't require a password prompt to be brought up/down. --- modules/nixos/services/wireguard/default.nix | 21 ++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/modules/nixos/services/wireguard/default.nix b/modules/nixos/services/wireguard/default.nix index a213e71..26e54e0 100644 --- a/modules/nixos/services/wireguard/default.nix +++ b/modules/nixos/services/wireguard/default.nix @@ -100,6 +100,8 @@ in options.my.services.wireguard = with lib; { enable = mkEnableOption "Wireguard VPN service"; + simpleManagement = my.mkDisableOption "manage units without password prompts"; + startAtBoot = mkEnableOption '' Should the VPN service be started at boot. Must be true for the server to work reliably. @@ -273,5 +275,24 @@ in after = [ "wg-quick-${cfg.iface}.service" ]; }; }) + + # Make it possible to manage those units without using passwords, for admins + (lib.mkIf cfg.simpleManagement { + environment.etc."polkit-1/rules.d/50-wg-quick.rules".text = '' + polkit.addRule(function(action, subject) { + if (action.id == "org.freedesktop.systemd1.manage-units") { + var unit = action.lookup("unit") + if (unit == "wg-quick-${cfg.iface}.service" || unit == "wg-quick-${cfg.internal.name}.service") { + var verb = action.lookup("verb"); + if (verb == "start" || verb == "stop" || verb == "restart") { + if (subject.isInGroup("wheel")) { + return polkit.Result.YES; + } + } + } + } + }); + ''; + }) ]); }