nixos/modules/services/misc/amazon-ssm-agent.nix

   1 { config, pkgs, lib, ... }:
   2 let
   3   cfg = config.services.amazon-ssm-agent;
   4
   5   # The SSM agent doesn't pay attention to our /etc/os-release yet, and the lsb-release tool
   6   # in nixpkgs doesn't seem to work properly on NixOS, so let's just fake the two fields SSM
   7   # looks for. See https://github.com/aws/amazon-ssm-agent/issues/38 for upstream fix.
   8   fake-lsb-release = pkgs.writeScriptBin "lsb_release" ''
   9     #!${pkgs.runtimeShell}
  10
  11     case "$1" in
  12       -i) echo "nixos";;
  13       -r) echo "${config.system.nixos.version}";;
  14     esac
  15   '';
  16
  17   sudoRule = {
  18     users = [ "ssm-user" ];
  19     commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ];
  20   };
  21 in {
  22   imports = [
  23     (lib.mkRenamedOptionModule [ "services" "ssm-agent" "enable" ] [ "services" "amazon-ssm-agent" "enable" ])
  24     (lib.mkRenamedOptionModule [ "services" "ssm-agent" "package" ] [ "services" "amazon-ssm-agent" "package" ])
  25   ];
  26
  27   options.services.amazon-ssm-agent = {
  28     enable = lib.mkEnableOption "Amazon SSM agent";
  29     package = lib.mkPackageOption pkgs "amazon-ssm-agent" {};
  30   };
  31
  32   config = lib.mkIf cfg.enable {
  33     # See https://github.com/aws/amazon-ssm-agent/blob/mainline/packaging/linux/amazon-ssm-agent.service
  34     systemd.services.amazon-ssm-agent = {
  35       inherit (cfg.package.meta) description;
  36       wants    = [ "network-online.target" ];
  37       after    = [ "network-online.target" ];
  38       wantedBy = [ "multi-user.target" ];
  39
  40       path = [
  41         fake-lsb-release
  42         pkgs.coreutils
  43         "/run/wrappers"
  44         "/run/current-system/sw"
  45       ];
  46
  47       serviceConfig = {
  48         ExecStart = "${cfg.package}/bin/amazon-ssm-agent";
  49         KillMode = "process";
  50         # We want this restating pretty frequently. It could be our only means
  51         # of accessing the instance.
  52         Restart = "always";
  53         RestartPreventExitStatus = 194;
  54         RestartSec = "90";
  55       };
  56     };
  57
  58     # Add user that Session Manager needs, and give it sudo.
  59     # This is consistent with Amazon Linux 2 images.
  60     security.sudo.extraRules = [ sudoRule ];
  61     security.sudo-rs.extraRules = [ sudoRule ];
  62
  63     # On Amazon Linux 2 images, the ssm-user user is pretty much a
  64     # normal user with its own group. We do the same.
  65     users.groups.ssm-user = {};
  66     users.users.ssm-user = {
  67       isNormalUser = true;
  68       group = "ssm-user";
  69     };
  70
  71     environment.etc."amazon/ssm/seelog.xml".source = "${cfg.package}/etc/amazon/ssm/seelog.xml.template";
  72
  73     environment.etc."amazon/ssm/amazon-ssm-agent.json".source =  "${cfg.package}/etc/amazon/ssm/amazon-ssm-agent.json.template";
  74
  75   };
  76 }