49 lines
1.2 KiB
Nix
49 lines
1.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.services.framework-control;
|
|
in
|
|
{
|
|
meta.maintainers = [ lib.maintainers.ozturkkl ];
|
|
|
|
options.services.framework-control = {
|
|
enable = lib.mkEnableOption "Framework Control device hardware service";
|
|
package = lib.mkPackageOption pkgs "framework-control" { };
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
environment.systemPackages = [ cfg.package ];
|
|
|
|
systemd.services.framework-control = {
|
|
description = "Framework Control Service";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
|
|
# framework-control shells out to framework_tool at runtime for hardware access
|
|
path = [ pkgs.framework-tool ];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = lib.getExe cfg.package;
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectHostname = true;
|
|
ProtectClock = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelLogs = true;
|
|
LockPersonality = true;
|
|
RestrictRealtime = true;
|
|
RestrictNamespaces = true;
|
|
SystemCallArchitectures = "native";
|
|
};
|
|
};
|
|
};
|
|
}
|