From ccf080ee055c620c6adc451c1b1b29a71ec0722a Mon Sep 17 00:00:00 2001 From: Anthony Roussel Date: Tue, 17 Oct 2023 23:01:15 +0200 Subject: amazon-ssm-agent: rename from ssm-agent --- nixos/modules/services/misc/amazon-ssm-agent.nix | 78 ++++++++++++++++++++++++ nixos/modules/services/misc/ssm-agent.nix | 73 ---------------------- 2 files changed, 78 insertions(+), 73 deletions(-) create mode 100644 nixos/modules/services/misc/amazon-ssm-agent.nix delete mode 100644 nixos/modules/services/misc/ssm-agent.nix (limited to 'nixos/modules/services/misc') diff --git a/nixos/modules/services/misc/amazon-ssm-agent.nix b/nixos/modules/services/misc/amazon-ssm-agent.nix new file mode 100644 index 000000000000..0be79e759c31 --- /dev/null +++ b/nixos/modules/services/misc/amazon-ssm-agent.nix @@ -0,0 +1,78 @@ +{ config, pkgs, lib, ... }: + +with lib; +let + cfg = config.services.amazon-ssm-agent; + + # The SSM agent doesn't pay attention to our /etc/os-release yet, and the lsb-release tool + # in nixpkgs doesn't seem to work properly on NixOS, so let's just fake the two fields SSM + # looks for. See https://github.com/aws/amazon-ssm-agent/issues/38 for upstream fix. + fake-lsb-release = pkgs.writeScriptBin "lsb_release" '' + #!${pkgs.runtimeShell} + + case "$1" in + -i) echo "nixos";; + -r) echo "${config.system.nixos.version}";; + esac + ''; +in { + imports = [ + (mkRenamedOptionModule [ "services" "ssm-agent" "enable" ] [ "services" "amazon-ssm-agent" "enable" ]) + (mkRenamedOptionModule [ "services" "ssm-agent" "package" ] [ "services" "amazon-ssm-agent" "package" ]) + ]; + + options.services.amazon-ssm-agent = { + enable = mkEnableOption (lib.mdDoc "Amazon SSM agent"); + + package = mkOption { + type = types.path; + description = lib.mdDoc "The Amazon SSM agent package to use"; + default = pkgs.amazon-ssm-agent.override { overrideEtc = false; }; + defaultText = literalExpression "pkgs.amazon-ssm-agent.override { overrideEtc = false; }"; + }; + }; + + config = mkIf cfg.enable { + systemd.services.amazon-ssm-agent = { + inherit (cfg.package.meta) description; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + path = [ fake-lsb-release pkgs.coreutils ]; + serviceConfig = { + ExecStart = "${cfg.package}/bin/amazon-ssm-agent"; + KillMode = "process"; + # We want this restating pretty frequently. It could be our only means + # of accessing the instance. + Restart = "always"; + RestartSec = "1min"; + }; + }; + + # Add user that Session Manager needs, and give it sudo. + # This is consistent with Amazon Linux 2 images. + security.sudo.extraRules = [ + { + users = [ "ssm-user" ]; + commands = [ + { + command = "ALL"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; + # On Amazon Linux 2 images, the ssm-user user is pretty much a + # normal user with its own group. We do the same. + users.groups.ssm-user = {}; + users.users.ssm-user = { + isNormalUser = true; + group = "ssm-user"; + }; + + environment.etc."amazon/ssm/seelog.xml".source = "${cfg.package}/seelog.xml.template"; + + environment.etc."amazon/ssm/amazon-ssm-agent.json".source = "${cfg.package}/etc/amazon/ssm/amazon-ssm-agent.json.template"; + + }; +} diff --git a/nixos/modules/services/misc/ssm-agent.nix b/nixos/modules/services/misc/ssm-agent.nix deleted file mode 100644 index d1f371c2bd61..000000000000 --- a/nixos/modules/services/misc/ssm-agent.nix +++ /dev/null @@ -1,73 +0,0 @@ -{ config, pkgs, lib, ... }: - -with lib; -let - cfg = config.services.ssm-agent; - - # The SSM agent doesn't pay attention to our /etc/os-release yet, and the lsb-release tool - # in nixpkgs doesn't seem to work properly on NixOS, so let's just fake the two fields SSM - # looks for. See https://github.com/aws/amazon-ssm-agent/issues/38 for upstream fix. - fake-lsb-release = pkgs.writeScriptBin "lsb_release" '' - #!${pkgs.runtimeShell} - - case "$1" in - -i) echo "nixos";; - -r) echo "${config.system.nixos.version}";; - esac - ''; -in { - options.services.ssm-agent = { - enable = mkEnableOption (lib.mdDoc "AWS SSM agent"); - - package = mkOption { - type = types.path; - description = lib.mdDoc "The SSM agent package to use"; - default = pkgs.ssm-agent.override { overrideEtc = false; }; - defaultText = literalExpression "pkgs.ssm-agent.override { overrideEtc = false; }"; - }; - }; - - config = mkIf cfg.enable { - systemd.services.ssm-agent = { - inherit (cfg.package.meta) description; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - - path = [ fake-lsb-release pkgs.coreutils ]; - serviceConfig = { - ExecStart = "${cfg.package}/bin/amazon-ssm-agent"; - KillMode = "process"; - # We want this restating pretty frequently. It could be our only means - # of accessing the instance. - Restart = "always"; - RestartSec = "1min"; - }; - }; - - # Add user that Session Manager needs, and give it sudo. - # This is consistent with Amazon Linux 2 images. - security.sudo.extraRules = [ - { - users = [ "ssm-user" ]; - commands = [ - { - command = "ALL"; - options = [ "NOPASSWD" ]; - } - ]; - } - ]; - # On Amazon Linux 2 images, the ssm-user user is pretty much a - # normal user with its own group. We do the same. - users.groups.ssm-user = {}; - users.users.ssm-user = { - isNormalUser = true; - group = "ssm-user"; - }; - - environment.etc."amazon/ssm/seelog.xml".source = "${cfg.package}/seelog.xml.template"; - - environment.etc."amazon/ssm/amazon-ssm-agent.json".source = "${cfg.package}/etc/amazon/ssm/amazon-ssm-agent.json.template"; - - }; -} -- cgit 1.4.1