nixos/howdy: init

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -89,8 +89,12 @@
 
 - [Privatebin](https://github.com/PrivateBin/PrivateBin/), a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Available as [services.privatebin](#opt-services.privatebin.enable).
 
+- [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
+
 - [UWSM](https://github.com/Vladimir-csp/uwsm), a wayland session manager to wrap Wayland compositors into useful systemd units such as `graphical-session.target`. Available as [programs.uwsm](#opt-programs.uwsm.enable).
 
+- [linux-enable-ir-emitter](https://github.com/EmixamPP/linux-enable-ir-emitter), a tool used to set up IR cameras, used with Howdy.
+
 - [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI for LLMs. Available as [services.open-webui](#opt-services.open-webui.enable).
 
 - [Quickwit](https://quickwit.io), a sub-second search & analytics engine on cloud storage. Available as [services.quickwit](options.html#opt-services.quickwit.enable).

nixos/modules/module-list.nix

@@ -788,6 +788,7 @@
   ./services/misc/lidarr.nix
   ./services/misc/lifecycled.nix
   ./services/misc/llama-cpp.nix
+  ./services/misc/linux-enable-ir-emitter.nix
   ./services/misc/logkeys.nix
   ./services/misc/mame.nix
   ./services/misc/mbpfan.nix
@@ -1324,6 +1325,7 @@
   ./services/security/hockeypuck.nix
   ./services/security/hologram-agent.nix
   ./services/security/hologram-server.nix
+  ./services/security/howdy
   ./services/security/infnoise.nix
   ./services/security/intune.nix
   ./services/security/jitterentropy-rngd.nix

nixos/modules/security/pam.nix

@@ -267,6 +267,16 @@ let
         '';
       };
 
+      howdyAuth = lib.mkOption {
+        default = config.services.howdy.enable;
+        defaultText = lib.literalExpression "config.services.howdy.enable";
+        type = lib.types.bool;
+        description = ''
+          If set, IR camera will be used (if it exists and your
+          facial models are enrolled).
+        '';
+      };
+
       oathAuth = lib.mkOption {
         default = config.security.pam.oath.enable;
         defaultText = lib.literalExpression "config.security.pam.oath.enable";
@@ -709,6 +719,7 @@ let
             dp9ik.authserver
           ]; })
           { name = "fprintd"; enable = cfg.fprintAuth; control = "sufficient"; modulePath = "${config.services.fprintd.package}/lib/security/pam_fprintd.so"; }
+          { name = "howdy"; enable = cfg.howdyAuth; control = "sufficient"; modulePath = "${config.services.howdy.package}/lib/security/pam_howdy.so"; }
         ] ++
           # Modules in this block require having the password set in PAM_AUTHTOK.
           # pam_unix is marked as 'sufficient' on NixOS which means nothing will run

nixos/modules/services/misc/linux-enable-ir-emitter.nix

@@ -0,0 +1,63 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.linux-enable-ir-emitter;
+in
+{
+  options = {
+    services.linux-enable-ir-emitter = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable IR emitter hardware. Designed to be used with the
+          Howdy facial authentication. After enabling the service, configure
+          the emitter with `sudo linux-enable-ir-emitter configure`.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "linux-enable-ir-emitter" { } // {
+        description = ''
+          Package to use for the Linux Enable IR Emitter service.
+        '';
+      };
+
+      device = lib.mkOption {
+        type = lib.types.str;
+        default = "video2";
+        description = ''
+          IR camera device to depend on. For example, for `/dev/video2`
+          the value would be `video2`. Find this with the command
+          {command}`realpath /dev/v4l/by-path/<generated-driver-name>`.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    # https://github.com/EmixamPP/linux-enable-ir-emitter/blob/7e3a6527ef2efccabaeefc5a93c792628325a8db/sources/systemd/linux-enable-ir-emitter.service
+    systemd.services.linux-enable-ir-emitter =
+      let
+        targets = [
+          "suspend.target"
+          "sleep.target"
+          "hybrid-sleep.target"
+          "hibernate.target"
+          "suspend-then-hibernate.target"
+        ];
+      in
+      {
+        description = "Enable the infrared emitter";
+        script = "${lib.getExe cfg.package} run";
+        serviceConfig.ConfigurationDirectory = "linux-enable-ir-emitter";
+        serviceConfig.StateDirectory = "linux-enable-ir-emitter";
+
+        wantedBy = targets ++ [ "multi-user.target" ];
+        after = targets ++ [ "dev-${cfg.device}.device" ];
+      };
+  };
+}

nixos/modules/services/security/howdy/config.nix

@@ -0,0 +1,46 @@
+{
+  core = {
+    detection_notice = false;
+    timeout_notice = true;
+    no_confirmation = false;
+    suppress_unknown = false;
+    abort_if_ssh = true;
+    abort_if_lid_closed = true;
+    disabled = false;
+    use_cnn = false;
+    workaround = "off";
+  };
+
+  video = {
+    certainty = 3.5;
+    timeout = 4;
+    device_path = "/dev/video2";
+    warn_no_device = true;
+    max_height = 320;
+    frame_width = -1;
+    frame_height = -1;
+    dark_threshold = 60;
+    recording_plugin = "opencv";
+    device_format = "v4l2";
+    force_mjpeg = false;
+    exposure = -1;
+    device_fps = -1;
+    rotate = 0;
+  };
+
+  snapshots = {
+    save_failed = false;
+    save_successful = false;
+  };
+
+  rubberstamps = {
+    enabled = false;
+    stamp_rules = "nod		5s		failsafe     min_distance=12";
+  };
+
+  debug = {
+    end_report = false;
+    verbose_stamps = false;
+    gtk_stdout = false;
+  };
+}

nixos/modules/services/security/howdy/default.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.howdy;
+  settingsType = pkgs.formats.ini { };
+in
+{
+  options = {
+    services.howdy = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable Howdy and its PAM module for face recognition. See
+          `services.linux-enable-ir-emitter` for enabling the IR emitter support.
+
+          ::: {.caution}
+          Howdy is not a safe alternative to unlocking with your password. It
+          can be fooled using a well-printed photo.
+
+          Do **not** use it as the sole authentication method for your system.
+          :::
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "howdy" { };
+
+      settings = lib.mkOption {
+        inherit (settingsType) type;
+        default = import ./config.nix;
+        description = ''
+          Howdy configuration file. Refer to
+          <https://github.com/boltgolt/howdy/blob/beta/howdy/src/config.ini>
+          for options.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      environment.systemPackages = [ cfg.package ];
+      environment.etc."howdy/config.ini".source = settingsType.generate "howdy-config.ini" cfg.settings;
+      assertions = [
+        {
+          assertion = !(builtins.elem "v4l2loopback" config.boot.kernelModules);
+          message = "Adding 'v4l2loopback' to `boot.kernelModules` causes Howdy to no longer work. Consider adding it to `boot.extraModulePackages` instead.";
+        }
+      ];
+    })
+    {
+      services.howdy.settings = lib.mapAttrsRecursive (name: lib.mkDefault) (import ./config.nix);
+    }
+  ];
+}

pkgs/by-name/ho/howdy/dont-install-config.patch

@@ -0,0 +1,16 @@
+diff --git a/howdy/src/meson.build b/howdy/src/meson.build
+index 6533951..ef60e0a 100644
+--- a/howdy/src/meson.build
++++ b/howdy/src/meson.build
+@@ -101,11 +101,6 @@ install_data(
+     rename: 'howdy',
+ )
+
+-fs = import('fs')
+-if not fs.exists(config_path)
+-    install_data('config.ini', install_dir: confdir, install_mode: 'rwxr--r--', install_tag: 'config')
+-endif
+-
+ install_data('dlib-data/install.sh', 'dlib-data/Readme.md', install_dir: dlibdatadir, install_mode: 'rwxr--r--')
+
+ install_man('../howdy.1')