Qualify hosted development and compose service ownership

restricted-execution/identity-module.nix

@@ -2,23 +2,45 @@
   executor,
   enable,
   controlGroup,
+  authorityUser ? "quixos-graph",
+  engineDirectory ? "/run/quixos-restricted-engines",
+  firstUid ? 610000,
+  identityCount ? 64,
+  wrapperName ? "quixos-restricted-engine",
 }:
 { config, lib, ... }:
 {
   config = lib.mkIf enable {
     assertions = [
       {
-        assertion = lib.all (user: user.uid == null || user.uid < 610000 || user.uid >= 610064) (
-          builtins.attrValues config.users.users
-        );
-        message = "UIDs 610000–610063 are reserved for restricted engine identities.";
+        assertion = lib.all (
+          user: user.uid == null || user.uid < firstUid || user.uid >= firstUid + identityCount
+        ) (builtins.attrValues config.users.users);
+        message = "UIDs ${toString firstUid}–${
+          toString (firstUid + identityCount - 1)
+        } are reserved for restricted engine identities.";
+      }
+      {
+        assertion = lib.all (
+          group: group.gid == null || group.gid < firstUid || group.gid >= firstUid + identityCount
+        ) (builtins.attrValues config.users.groups);
+        message = "Restricted engine GIDs must not overlap host groups.";
       }
     ];
     systemd.tmpfiles.rules = [
-      "d /run/quixos-restricted-engines 0711 quixos-graph ${controlGroup} -"
+      "d ${engineDirectory} 0711 ${authorityUser} ${controlGroup} -"
     ];
-    security.wrappers.quixos-restricted-engine = {
-      source = "${executor.identityLauncher}/bin/quixos-restricted-engine";
+    security.wrappers.${wrapperName} = {
+      source = "${
+        executor.mkIdentityLauncher {
+          inherit
+            authorityUser
+            engineDirectory
+            firstUid
+            identityCount
+            ;
+        }
+      }/bin/quixos-restricted-engine";
       owner = "root";
       group = controlGroup;
       permissions = "u+rx,g+rx,o-rwx";