diff options
Diffstat (limited to 'nixpkgs/nixos/modules/services/security/haveged.nix')
-rw-r--r-- | nixpkgs/nixos/modules/services/security/haveged.nix | 67 |
1 files changed, 67 insertions, 0 deletions
diff --git a/nixpkgs/nixos/modules/services/security/haveged.nix b/nixpkgs/nixos/modules/services/security/haveged.nix new file mode 100644 index 000000000000..eca529188810 --- /dev/null +++ b/nixpkgs/nixos/modules/services/security/haveged.nix @@ -0,0 +1,67 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.services.haveged; + +in + + +{ + + ###### interface + + options = { + + services.haveged = { + + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable to haveged entropy daemon, which refills + /dev/random when low. + ''; + }; + + refill_threshold = mkOption { + type = types.int; + default = 1024; + description = '' + The number of bits of available entropy beneath which + haveged should refill the entropy pool. + ''; + }; + + }; + + }; + + + ###### implementation + + config = mkIf cfg.enable { + + systemd.services.haveged = + { description = "Entropy Harvesting Daemon"; + unitConfig.Documentation = "man:haveged(8)"; + wantedBy = [ "multi-user.target" ]; + + path = [ pkgs.haveged ]; + + serviceConfig = { + ExecStart = "${pkgs.haveged}/bin/haveged -F -w ${toString cfg.refill_threshold} -v 1"; + SuccessExitStatus = 143; + PrivateTmp = true; + PrivateDevices = true; + PrivateNetwork = true; + ProtectSystem = "full"; + ProtectHome = true; + }; + }; + + }; + +} |