Allow gitolite to control infinoted

1 files changed, 19 insertions, 0 deletions

diff --git a/ymir.nix b/ymir.nix
index e8837dcd..83fa823f 100644
--- a/ymir.nix
+++ b/ymir.nix
@@ -611,11 +611,30 @@ in rec {
   users.extraGroups."mladmin" = {
     members = [ "gkleen" ];
   };
+  
+  users.extraGroups."infinoted" = {
+    members = [ "infinoted gitolite" ];
+  };
 
   security.sudo.extraConfig = ''
     %mladmin ALL=(mlmmj) NOPASSWD: ALL
+    %infinoted ALL=(infinoted) NOPASSWD: ALL
   '';
 
+  security.polkit = {
+      enable = true;
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (    action.id == "org.freedesktop.systemd1.manage-units"
+               && action.lookup("unit") == "infinoted.service"
+               && subject.isInGroup("infinoted")
+             ) {
+              return polkit.Result.YES;
+          }
+        });
+      '';
+    };
+
   security.setuidPrograms = [ "newgrp" ];
 
   security.acme = {