1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
{
config,
pkgs,
lib,
cfg,
doctrine,
...
}: let
athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release};
inherit (athena) vendor;
driver = athena.card-driver.lib;
scmiddleware = "${driver}/lib/SCMiddleware";
in {
environment = {
etc =
{
"pkcs11/modules/${vendor}".text = ''
module: ${athena.pkcs11-module}
'';
}
// lib.optionalAttrs (vendor == "athena") {
"Athena".source = "${driver}/etc/Athena";
}
// lib.optionalAttrs (vendor == "idopte") {
"idoss.conf".source = "${driver}/etc/idoss.conf";
"idoss.lic".source = "${driver}/etc/idoss.lic";
"SCMiddleware".source = scmiddleware;
};
systemPackages = [athena.card-driver];
};
security = {
#FIXME: Extremadamente peligroso si BCCR o MICITT caen, investigar política nacional de root CA
pki.certificateFiles = ["${athena.bccr-cacerts}/root-ca.pem"];
polkit = {
enable = lib.mkDefault true;
extraConfig = ''
polkit.addRule(function(action, subject) {
if ((action.id == "org.debian.pcsc-lite.access_pcsc" || action.id == "org.debian.pcsc-lite.access_card") &&
subject.isInGroup("users")) {
return polkit.Result.YES;
}
});
'';
};
};
services = {
pcscd.enable = true;
udev.extraRules =
lib.optionalString (vendor == "athena") ''
# Athena Smartcard Solutions, Inc. ASEDrive V3CR
ATTRS{idVendor}=="0dc3", ATTRS{idProduct}=="1004", MODE="660", GROUP="${cfg.group}", TAG+="uaccess"
''
+ lib.optionalString (vendor == "idopte") ''
# Bit4id Srl miniLector-s
ACTION=="add", SUBSYSTEM=="usb", ENV{PRODUCT}=="25dd/1101*", RUN+="${config.systemd.package}/bin/systemctl start --no-block idopte-reader.target"
ACTION=="remove", SUBSYSTEM=="usb", ENV{PRODUCT}=="25dd/1101*", RUN+="${config.systemd.package}/bin/systemctl stop --no-block idopte-reader.target"
'';
};
systemd = lib.mkIf (vendor == "idopte") {
#TODO: make this run as a non-root user
services.idopte-cache = {
description = "Idopte cache server";
after = ["smartcard.target"];
bindsTo = ["idopte-reader.target"];
wantedBy = ["idopte-reader.target"];
serviceConfig = {
Type = "forking";
PIDFile = "/run/idoCacheSrv.pid";
RuntimeDirectory = "idoss";
ExecStart = "${scmiddleware}/idocachesrv";
};
};
targets.idopte-reader = {
description = "Idopte USB reader inserted";
wants = ["smartcard.target"];
before = ["smartcard.target"];
};
};
users.groups.${cfg.group} = {};
}
|
