services/turnstiled: init

modules/services/turnstile/README.md

@@ -0,0 +1,9 @@
+# Turnstile
+
+An experimental module for
+[turnstile](https://github.com/chimera-linux/turnstile).
+
+Turnstile is a session/login tracker that runs a user level dinit/runit instance
+when a user logs in and closes is safely when they log out.
+
+This module is subject to extreme changes at any point.

modules/services/turnstile/default.nix

@@ -0,0 +1,225 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.turnstile;
+
+  package = pkgs.callPackage ./package.nix { graphicalMonitor = cfg.dinit.enableGraphicalMonitor; };
+in
+{
+  options.services.turnstile = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable [turnstilel](${cfg.package.meta.homepage}).
+      '';
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = package;
+      description = ''
+        The package to use for `turnstile`.
+      '';
+    };
+
+    configFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/etc/turnstiled.conf";
+      description = "Configuration file location for tunrstiled";
+    };
+
+    systemBootDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/usr/lib/dinit.d/user/boot.d";
+      description = "Location of boot services used for all users";
+    };
+
+    settings =
+      with lib;
+      mkOption {
+        type =
+          with types;
+          submodule {
+            options = {
+              debug = mkOption {
+                type = enum [
+                  "yes"
+                  "no"
+                ];
+                default = "no";
+                description = "Whether or not to enable debug output in turnstile";
+              };
+              backend = mkOption {
+                type = enum [
+                  "dinit"
+                  "runit"
+                ];
+                default = "dinit";
+                description = "`runit` is not currently supported, but changing this option may break things";
+              };
+              debug_stderr = mkOption {
+                type = enum [
+                  "yes"
+                  "no"
+                ];
+                default = "no";
+                description = "Whether or not to print debug to stderr in addition to stdout";
+              };
+              linger = mkOption {
+                type = enum [
+                  "yes"
+                  "no"
+                ];
+                default = "no";
+                description = "Whether or not the service manager should linger after user logout. Requires ${cfg.settings.manage_rundir} to be enabled";
+              };
+              rundir_path = mkOption {
+                type = str;
+                default = "/run/user/%u";
+                description = "Where the rundir is for the user. See [turnstile](${cfg.package.meta.homepage}) documentation for available options";
+              };
+              manage_rundir = mkOption {
+                type = enum [
+                  "yes"
+                  "no"
+                ];
+                default = "no";
+                description = "Whether or not `turnstile` should manage the runtime directory";
+
+              };
+              export_dbus_address = mkOption {
+                type = enum [
+                  "yes"
+                  "no"
+                ];
+                default = "yes";
+                description = "Whether or not to export the D-Bus session address to the environment of the service manager";
+              };
+              login_timeout = mkOption {
+                type = ints.unsigned;
+                default = 60;
+                description = "How long the service manager waits on initial processes (in seconds) before giving up.";
+              };
+              root_session = mkOption {
+                type = enum [
+                  "yes"
+                  "no"
+                ];
+                default = "no";
+                description = "Whether or not `turnstile` acts for the root user.";
+              };
+            };
+          };
+      };
+
+    dinit =
+      with lib;
+      mkOption {
+        type =
+          with types;
+          submodule {
+            options = {
+              enable = mkOption {
+                type = bool;
+                default = true;
+                description = "Whether or not to use the dinit backend for `turnstile`.";
+              };
+
+              service_dir = mkOption {
+                type = str;
+                default = "$HOME/.config/dinit.d";
+                description = "Users service dir for `turnstile`'s `dinit` backend. This should include a way to differentiate per user unless all users have identical services.";
+              };
+
+              boot_dir = mkOption {
+                type = str;
+                default = "${cfg.dinit.service_dir}/boot.d";
+                description = "Users service boot dir for `turnstile`'s `dinit` backend. This should include a way to differentiate per user unless all users have identical services.";
+              };
+
+              system_boot_dir = mkOption {
+                type = path;
+                default = "/usr/lib/dinit.d/user/boot.d";
+                description = "Systems service boot dir for `turnstile`'s `dinit` backend.";
+              };
+
+              enableGraphicalMonitor = mkOption {
+                type = bool;
+                default = false;
+                description = "Whether or not to monitor environment changes to DISPLAY and WAYLAND_DISPLAY variables. Currently requires manually adding `dinitctl setenv VAR=$VAR`to any startup scripts for your graphical environment to function.";
+              };
+            };
+          };
+      };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      cfg.package
+    ]
+    ++ lib.lists.optional cfg.dinit.enable (lib.lowPrio pkgs.dinit);
+
+    finit.tmpfiles.rules = [
+      "d ${cfg.dinit.system_boot_dir} 0777"
+    ];
+
+    environment.etc = {
+      "turnstile/turnstiled.conf".text = ''
+        debug = ${cfg.settings.debug}
+        backend = ${cfg.settings.backend}
+        debug_stderr = ${cfg.settings.debug_stderr}
+        linger = ${cfg.settings.linger}
+        rundir_path = ${cfg.settings.rundir_path}
+        manage_rundir = ${cfg.settings.manage_rundir}
+        export_dbus_address = ${cfg.settings.export_dbus_address}
+        login_timeout = ${toString cfg.settings.login_timeout}
+        root_session = ${cfg.settings.root_session}
+        			'';
+
+      "turnstile/backend/dinit.conf".text = ''
+        boot_dir="${cfg.dinit.boot_dir}"
+        system_boot_dir="${cfg.dinit.system_boot_dir}"
+        services_dir1="${cfg.dinit.service_dir}"
+        services_dir2="/etc/dinit.d/user"
+        services_dir3="/usr/local/lib/dinit.d/user"
+        services_dir4="/usr/lib/dinit.d/user"
+        			'';
+
+      "pam.d/turnstiled".text = ''
+        auth		sufficient	pam_rootok.so
+        session		optional	pam_keyinit.so force revoke
+        session		optional	pam_umask.so usergroups umask=022
+        -session	optional	pam_elogind.so
+        session		required  pam_env.so conffile=/etc/security/pam_env.conf readenv=1 # env (order 10100)
+        session		required	${cfg.package}/pam/pam_turnstile.so turnstiled
+        session		required	pam_limits.so
+      '';
+    };
+
+    security.pam.services = lib.mkMerge [
+      {
+        login.text = lib.mkAfter "session optional ${cfg.package}/pam/pam_turnstile.so";
+      }
+    ];
+
+    finit.services.turnstiled = {
+      description = "turnstiled, a user-service manager manager";
+      command = "${cfg.package}/bin/turnstiled";
+      conditions = "service/syslogd/ready";
+      log = true;
+      pid = "/run/turnstiled.pid";
+      path =
+        with pkgs;
+        [
+          cfg.package
+          coreutils
+        ]
+        ++ lib.lists.optional cfg.dinit.enable (lib.lowPrio dinit);
+    };
+  };
+}

modules/services/turnstile/package.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  pkgs,
+  stdenv,
+  fetchFromGitHub,
+  graphicalMonitor ? true,
+}:
+
+stdenv.mkDerivation {
+  pname = "turnstile";
+  version = "0-unstable-2025-12-15";
+
+  src = fetchFromGitHub {
+    owner = "chimera-linux";
+    repo = "turnstile";
+    rev = "e3413dad386bf72048646f9f9ffd3a8d60e10eb0";
+    sha256 = "sha256-TH0zLYKgDup+byBxr68R3DWt1/+BFJIkXWSuqSHAEOE=";
+  };
+
+  nativeBuildInputs = with pkgs; [
+    pkg-config
+    scdoc
+    meson
+    ninja
+    pam
+  ];
+
+  buildInputs = with pkgs; [
+    dinit
+  ];
+
+  mesonFlags = [
+    "-Ddefault_backend=dinit"
+    "-Ddinit=enabled"
+    "-Dstatedir=/var/lib/turnstiled"
+    "-Dpam_moddir=./pam"
+  ];
+
+  patches = [
+    ./patch.diff
+  ]
+  ++ lib.lists.optional (!graphicalMonitor) (./remove_graphical_monitor.diff);
+
+  doInstallCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/chimera-linux/turnstile";
+    description = "This program waits for user logins and then runs the associated user-service manager";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ vitrial ];
+    platforms = platforms.linux;
+    mainProgram = "turnstiled";
+  };
+
+}

modules/services/turnstile/patch.diff

@@ -0,0 +1,26 @@
+diff --git a/backend/dinit b/backend/dinit
+index 7bacaac..065d14a 100644
+--- a/backend/dinit
++++ b/backend/dinit
+@@ -136,7 +136,7 @@ cat << EOF > "${DINIT_DIR}/graphical.monitor"
+ type = process
+ depends-on = login.target
+ options = pass-cs-fd
+-command = /usr/bin/dinit-monitor -E -c "$0 graphical-notify" WAYLAND_DISPLAY DISPLAY
++command = /run/current-system/sw/bin/dinit-monitor -E -c "$0 graphical-notify" WAYLAND_DISPLAY DISPLAY
+ EOF
+
+ # this is needed for login to proceed
+diff --git a/meson.build b/meson.build
+index aa07c9c..fdf89fa 100644
+--- a/meson.build
++++ b/meson.build
+@@ -28,7 +28,7 @@ have_runit = get_option('runit').enabled()
+ conf_data = configuration_data()
+ conf_data.set_quoted('RUN_PATH', get_option('rundir'))
+ conf_data.set_quoted('CONF_PATH', join_paths(
+-    get_option('prefix'), get_option('sysconfdir'), 'turnstile'
++    '/etc/', 'turnstile'
+ ))
+ conf_data.set10('MANAGE_RUNDIR', get_option('manage_rundir'))
+

modules/services/turnstile/remove_graphical_monitor.diff

@@ -0,0 +1,38 @@
+diff --git a/backend/dinit b/backend/dinit
+index 7bacaac..27ee9b7 100644
+--- a/backend/dinit
++++ b/backend/dinit
+@@ -121,8 +121,6 @@ type = internal
+ depends-on = system
+ waits-for.d = ${boot_dir}
+ depends-on = login.target
+-depends-ms = graphical.monitor
+-depends-ms = graphical.target
+ EOF
+
+ # this must also succeed
+@@ -131,24 +129,9 @@ type = internal
+ waits-for.d = ${system_boot_dir}
+ EOF
+
+-# monitor service to watch for environment changes
+-cat << EOF > "${DINIT_DIR}/graphical.monitor"
+-type = process
+-depends-on = login.target
+-options = pass-cs-fd
+-command = /run/current-system/sw/bin/dinit-monitor -E -c "$0 graphical-notify" WAYLAND_DISPLAY DISPLAY
+-EOF
+-
+ # this is needed for login to proceed
+ cat << EOF > "${DINIT_DIR}/login.target"
+ type = internal
+ EOF
+
+-# this is not necessary to have started for login to proceed
+-cat << EOF > "${DINIT_DIR}/graphical.target"
+-type = triggered
+-depends-on = graphical.monitor
+-depends-on = login.target
+-EOF
+-
+ exec dinit --user --ready-fd 3 --services-dir "$DINIT_DIR" "$@" 3>"$DINIT_READY_PIPE"