12{3 config,4 lib,5 pkgs,6 utils,7 ...8}:9let10 inherit (lib)11 mkEnableOption12 mkIf13 mkOption14 mkPackageOption15 types16 ;17 inherit (lib.lists) optionals;18 cfg = config.services.fleet-usbd;19 devicePath = "/dev/disk/by-label/${cfg.label}";20 deviceUnit = "${utils.escapeSystemdPath devicePath}.device";21in22{23 options.services.fleet-usbd = {24 enable = mkEnableOption "fleet USB update daemon";25 package = mkPackageOption pkgs "fleet-usbd" { };26 label = mkOption {27 type = types.str;28 default = "FLEETUSBD";29 description = ''30 Volume label of the update stick, matching the label passed to31 `fleet usbd write`. FAT32 labels are at most 11 characters, uppercase.32 '';33 };34 signPublicKeys = mkOption {35 type = types.listOf types.str;36 description = ''37 Nix public keys the update closure is signed with38 (the counterparts of `fleet usbd write --sign-key`).39 '';40 };41 hook = mkOption {42 type = types.nullOr types.path;43 default = null;44 description = ''45 User feedback script, executed on update lifecycle events with the46 event name as the first argument: copying, switching, done, noop,47 failed <error>.48 '';49 };50 extraArgs = mkOption {51 type = types.listOf types.str;52 default = [ ];53 description = "Extra arguments for the fleet-usbd invocation.";54 };55 };5657 config = mkIf cfg.enable {58 nix.settings.trusted-public-keys = cfg.signPublicKeys;5960 systemd.services.fleet-usbd = {61 description = "Fleet USB update daemon";62 wantedBy = [ deviceUnit ];63 after = [64 deviceUnit65 "local-fs.target"66 ];67 serviceConfig = {68 Type = "oneshot";69 ExecStartPre = "-${pkgs.dosfstools}/bin/fsck.vfat -a ${devicePath}";70 ExecStart = utils.escapeSystemdExecArgs (71 [72 (lib.getExe cfg.package)73 "--device"74 devicePath75 ]76 ++ optionals (cfg.hook != null) [77 "--hook"78 cfg.hook79 ]80 ++ cfg.extraArgs81 );82 };83 unitConfig = {84 X-RestartIfChanged = false;85 X-StopIfChanged = false;86 };87 };88 };89}