6 files changed, 105 insertions, 100 deletions

diff --git a/custom/thermoprint b/custom/thermoprint
-Subproject e95dac748371afcad3ffddf5c98e5fcb0a8302b
+Subproject ba2e44af40746f339e1ed652ea233c739790556
diff --git a/custom/tinc/def.nix b/custom/tinc/def.nix
index 58c5237c..563335ad 100644
--- a/custom/tinc/def.nix
+++ b/custom/tinc/def.nix
@@ -6,6 +6,77 @@ let
 
   cfg = config.services.customTinc;
 
+  networkModule = {
+    extraConfig = mkOption {
+      default = ''
+        PingTimeout = 10
+      '';
+      type = types.lines;
+      description = ''
+        Extra lines to add to the tinc service configuration file.
+      '';
+    };
+
+    name = mkOption {
+      default = null;
+      type = types.nullOr types.str;
+      description = ''
+        The name of the node which is used as an identifier when communicating
+        with the remote nodes in the mesh. If null then the hostname of the system
+        is used.
+      '';
+    };
+
+    debugLevel = mkOption {
+      default = 0;
+      type = types.addCheck types.int (l: l >= 0 && l <= 5);
+      description = ''
+        The amount of debugging information to add to the log. 0 means little
+        logging while 5 is the most logging. <command>man tincd</command> for
+        more details.
+      '';
+    };
+
+    hosts = mkOption {
+      default = { };
+      type = types.loaOf types.lines;
+      description = ''
+        The name of the host in the network as well as the configuration for that host.
+        This name should only contain alphanumerics and underscores.
+      '';
+    };
+
+    interfaceType = mkOption {
+      default = "tun";
+      type = types.addCheck types.str (n: n == "tun" || n == "tap");
+      description = ''
+        The type of virtual interface used for the network connection
+      '';
+    };
+
+    interfaceConfig = mkOption {
+      default = { };
+      description = ''
+        Additional configuration for the generated network interface
+      '';
+    };
+
+    package = mkOption {
+      default = pkgs.tinc_pre;
+      description = ''
+        The package to use for the tinc daemon's binary.
+      '';
+    };
+
+    scripts = mkOption {
+      default = { };
+      type = types.loaOf (types.nullOr types.str);
+      description = ''
+        Hook scripts
+      '';
+    };
+
+  };
 in
 
 {
@@ -18,83 +89,11 @@ in
 
       networks = mkOption {
         default = { };
-        type = types.loaOf types.optionSet;
+        type = types.loaOf (types.submodule { options = networkModule; });
         description = ''
           Defines the tinc networks which will be started.
           Each network invokes a different daemon.
         '';
-        options = {
-
-          extraConfig = mkOption {
-            default = ''
-              PingTimeout = 10
-            '';
-            type = types.lines;
-            description = ''
-              Extra lines to add to the tinc service configuration file.
-            '';
-          };
-
-          name = mkOption {
-            default = null;
-            type = types.nullOr types.str;
-            description = ''
-              The name of the node which is used as an identifier when communicating
-              with the remote nodes in the mesh. If null then the hostname of the system
-              is used.
-            '';
-          };
-
-          debugLevel = mkOption {
-            default = 0;
-            type = types.addCheck types.int (l: l >= 0 && l <= 5);
-            description = ''
-              The amount of debugging information to add to the log. 0 means little
-              logging while 5 is the most logging. <command>man tincd</command> for
-              more details.
-            '';
-          };
-
-          hosts = mkOption {
-            default = { };
-            type = types.loaOf types.lines;
-            description = ''
-              The name of the host in the network as well as the configuration for that host.
-              This name should only contain alphanumerics and underscores.
-            '';
-          };
-
-          interfaceType = mkOption {
-            default = "tun";
-            type = types.addCheck types.str (n: n == "tun" || n == "tap");
-            description = ''
-              The type of virtual interface used for the network connection
-            '';
-          };
-
-          interfaceConfig = mkOption {
-            default = { };
-            description = ''
-              Additional configuration for the generated network interface
-            '';
-          };
-
-          package = mkOption {
-            default = pkgs.tinc_pre;
-            description = ''
-              The package to use for the tinc daemon's binary.
-            '';
-          };
-
-          scripts = mkOption {
-            default = { };
-            type = types.loaOf (types.nullOr types.str);
-            description = ''
-              Hook scripts
-            '';
-          };
-
-        };
       };
     };
 
diff --git a/custom/trivmix b/custom/trivmix
-Subproject 72467d55a7b6e3afcafc2cd1527da10574cf636
+Subproject 70e600346fb5875defe14d578883c9838695d53
diff --git a/custom/trivmix-service.nix b/custom/trivmix-service.nix
index 3c3cded7..e9120f88 100644
--- a/custom/trivmix-service.nix
+++ b/custom/trivmix-service.nix
@@ -3,43 +3,40 @@
 , connectOut ? null
 , connectIn ? null
 , group ? null
+, initial ? null
 , trivmix
 , stdenv
 , makeWrapper
 , jack2Full
 , coreutils
+, writeScript
 }:
 
 let
-  genRun = if ! isNull run then run else (
-    "${derivRun}/bin/run.sh"
-  );
-  derivRun = stdenv.mkDerivation {
-    name = "trivmix-run";
-    src = builtins.toFile "run.sh" ''
-      #!/bin/sh
+  connect = (! isNull connectOut) || (! isNull connectIn);
+  connectScript = writeScript "connect" ''
+    #!${stdenv.shell}
 
-      ${if ! isNull connectIn then "jack_connect ${connectIn} $1" else ""}
-      ${if ! isNull connectOut then "jack_connect $2 ${connectOut}" else ""}
-    '';
-    unpackPhase = "cat";
-    buildInputs = [ makeWrapper ];
-    installPhase = ''
-      mkdir -p $out/bin
-      cp $src $out/bin/run.sh
-      chmod 755 $out/bin/run.sh
-      wrapProgram $out/bin/run.sh \
-        --prefix PATH : ${jack2Full}/bin
-    '';
-  };
-in rec {
+    PATH=${jack2Full}/bin:$PATH
+
+    ${optionalString (! isNull connectIn) "jack_connect ${connectIn} $1"}
+    ${optionalString (! isNull connectOut) "jack_connect $2 ${connectOut}"}
+  '';
+  inherit (stdenv.lib) optionalString;
+in {
   out = {
     wantedBy = [ "sound.target" ];
     requires = [ "jack.service" ];
     before = [ "mpd.service" ];
     serviceConfig = {
       Type = "simple";
-      ExecStart = ''${trivmix}/bin/trivmix --client ${name} --run ${genRun} /dev/shm/mix/${name}/level${if ! isNull group then " /dev/shm/mix/${group}/level" else ""}'';
+      ExecStart = ''${trivmix}/bin/trivmix --client ${name} \
+        ${optionalString connect "--run ${connectScript}"} \
+        ${optionalString (! isNull run) "--run ${run}"} \
+        ${optionalString (! isNull initial) "--level ${initial}"} \
+        /dev/shm/mix/${name}/level \
+        ${optionalString (! isNull group) "/dev/shm/mix/${group}/level"}
+      '';
       User = "jack";
       Group = "audio";
       Nice = "-10";
diff --git a/custom/trivmix.nix b/custom/trivmix.nix
deleted file mode 120000
index c2f64840..00000000
--- a/custom/trivmix.nix
+++ /dev/null
@@ -1 +0,0 @@
-trivmix/package.nix
\ No newline at end of file
diff --git a/custom/uucp.nix b/custom/uucp.nix
index d7c2aae2..0b4b1306 100644
--- a/custom/uucp.nix
+++ b/custom/uucp.nix
@@ -208,7 +208,17 @@ in {
       text = config.services.uucp.extraSys + "\n" + concatStringsSep "\n" (map sysSpec config.services.uucp.remoteNodes);
     };
 
-    security.setuidOwners = map (p: {program = p; owner = "root"; group = "root"; setuid = true; setgid = false;}) ["uucico" "uuxqt" "cu" "uucp" "uuname" "uustat" "uux"];
+    security.wrappers = let
+      wrapper = p: { name = p;
+                     value = {
+                       source = "${pkgs.uucp}/bin/${p}";
+                       owner = "root";
+                       group = "root";
+                       setuid = true;
+                       setgid = false;
+                     };
+                   };
+    in listToAttrs (map wrapper ["uucico" "uuxqt" "cu" "uucp" "uuname" "uustat" "uux"]);
 
     nixpkgs.config.packageOverrides = pkgs: with pkgs; {
       uucp = stdenv.lib.overrideDerivation uucp (oldAttrs: {
@@ -227,7 +237,7 @@ in {
                 choices as appropriate.  */
              #if 1
             -#define MAIL_PROGRAM "/usr/lib/sendmail -t"
-            +#define MAIL_PROGRAM "/var/setuid-wrappers/sendmail -t"
+            +#define MAIL_PROGRAM "${config.security.wrapperDir}/sendmail -t"
              /* #define MAIL_PROGRAM "/usr/sbin/sendmail -t" */
              #define MAIL_PROGRAM_TO_BODY 1
              #define MAIL_PROGRAM_SUBJECT_BODY 1
@@ -246,7 +256,7 @@ in {
             *) from="$from@$relay";;
           esac
 
-          exec /var/setuid-wrappers/sendmail -i -f "$from" -- "$@"
+          exec ${config.security.wrapperDir}/sendmail -G -i -f "$from" -- "$@"
         '';
     };
 
@@ -254,6 +264,6 @@ in {
       uucp
     ];
 
-    services.cron.systemCronJobs = (map (name: "${config.services.uucp.interval} /var/setuid-wrappers/uucico -D -S ${name}") (if (config.services.uucp.interval != null) then config.services.uucp.remoteNodes else []));
+    services.cron.systemCronJobs = (map (name: "${config.services.uucp.interval} ${config.security.wrapperDir}/uucico -D -S ${name}") (if (config.services.uucp.interval != null) then config.services.uucp.remoteNodes else []));
   };
 }