nixos/security.duosec: remove with lib;

nixos/modules/security/duosec.nix

@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.security.duosec;
 
@@ -11,7 +8,7 @@ let
     [duo]
     ikey=${cfg.integrationKey}
     host=${cfg.host}
-    ${optionalString (cfg.groups != "") ("groups="+cfg.groups)}
+    ${lib.optionalString (cfg.groups != "") ("groups="+cfg.groups)}
     failmode=${cfg.failmode}
     pushinfo=${boolToStr cfg.pushinfo}
     autopush=${boolToStr cfg.autopush}
@@ -26,32 +23,32 @@ let
 in
 {
   imports = [
-    (mkRenamedOptionModule [ "security" "duosec" "group" ] [ "security" "duosec" "groups" ])
-    (mkRenamedOptionModule [ "security" "duosec" "ikey" ] [ "security" "duosec" "integrationKey" ])
-    (mkRemovedOptionModule [ "security" "duosec" "skey" ] "The insecure security.duosec.skey option has been replaced by a new security.duosec.secretKeyFile option. Use this new option to store a secure copy of your key instead.")
+    (lib.mkRenamedOptionModule [ "security" "duosec" "group" ] [ "security" "duosec" "groups" ])
+    (lib.mkRenamedOptionModule [ "security" "duosec" "ikey" ] [ "security" "duosec" "integrationKey" ])
+    (lib.mkRemovedOptionModule [ "security" "duosec" "skey" ] "The insecure security.duosec.skey option has been replaced by a new security.duosec.secretKeyFile option. Use this new option to store a secure copy of your key instead.")
   ];
 
   options = {
     security.duosec = {
-      ssh.enable = mkOption {
-        type = types.bool;
+      ssh.enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "If enabled, protect SSH logins with Duo Security.";
       };
 
-      pam.enable = mkOption {
-        type = types.bool;
+      pam.enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "If enabled, protect logins with Duo Security using PAM support.";
       };
 
-      integrationKey = mkOption {
-        type = types.str;
+      integrationKey = lib.mkOption {
+        type = lib.types.str;
         description = "Integration key.";
       };
 
-      secretKeyFile = mkOption {
-        type = types.nullOr types.path;
+      secretKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           A file containing your secret key. The security of your Duo application is tied to the security of your secret key.
@@ -59,13 +56,13 @@ in
         example = "/run/keys/duo-skey";
       };
 
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         description = "Duo API hostname.";
       };
 
-      groups = mkOption {
-        type = types.str;
+      groups = lib.mkOption {
+        type = lib.types.str;
         default = "";
         example = "users,!wheel,!*admin guests";
         description = ''
@@ -76,8 +73,8 @@ in
         '';
       };
 
-      failmode = mkOption {
-        type = types.enum [ "safe" "secure" ];
+      failmode = lib.mkOption {
+        type = lib.types.enum [ "safe" "secure" ];
         default = "safe";
         description = ''
           On service or configuration errors that prevent Duo
@@ -86,8 +83,8 @@ in
         '';
       };
 
-      pushinfo = mkOption {
-        type = types.bool;
+      pushinfo = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Include information such as the command to be executed in
@@ -95,8 +92,8 @@ in
         '';
       };
 
-      autopush = mkOption {
-        type = types.bool;
+      autopush = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           If `true`, Duo Unix will automatically send
@@ -109,8 +106,8 @@ in
         '';
       };
 
-      motd = mkOption {
-        type = types.bool;
+      motd = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Print the contents of `/etc/motd` to screen
@@ -118,8 +115,8 @@ in
         '';
       };
 
-      prompts = mkOption {
-        type = types.enum [ 1 2 3 ];
+      prompts = lib.mkOption {
+        type = lib.types.enum [ 1 2 3 ];
         default = 3;
         description = ''
           If a user fails to authenticate with a second factor, Duo
@@ -139,8 +136,8 @@ in
         '';
       };
 
-      acceptEnvFactor = mkOption {
-        type = types.bool;
+      acceptEnvFactor = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Look for factor selection or passcode in the
@@ -154,8 +151,8 @@ in
         '';
       };
 
-      fallbackLocalIP = mkOption {
-        type = types.bool;
+      fallbackLocalIP = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Duo Unix reports the IP address of the authorizing user, for
@@ -170,8 +167,8 @@ in
         '';
       };
 
-      allowTcpForwarding = mkOption {
-        type = types.bool;
+      allowTcpForwarding = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           By default, when SSH forwarding, enabling Duo Security will
@@ -183,7 +180,7 @@ in
     };
   };
 
-  config = mkIf (cfg.ssh.enable || cfg.pam.enable) {
+  config = lib.mkIf (cfg.ssh.enable || cfg.pam.enable) {
     environment.systemPackages = [ pkgs.duo-unix ];
 
     security.wrappers.login_duo =
@@ -240,12 +237,12 @@ in
 
     /* If PAM *and* SSH are enabled, then don't do anything special.
     If PAM isn't used, set the default SSH-only options. */
-    services.openssh.extraConfig = mkIf (cfg.ssh.enable || cfg.pam.enable) (
+    services.openssh.extraConfig = lib.mkIf (cfg.ssh.enable || cfg.pam.enable) (
     if cfg.pam.enable then "UseDNS no" else ''
       # Duo Security configuration
       ForceCommand ${config.security.wrapperDir}/login_duo
       PermitTunnel no
-      ${optionalString (!cfg.allowTcpForwarding) ''
+      ${lib.optionalString (!cfg.allowTcpForwarding) ''
         AllowTcpForwarding no
       ''}
     '');