|
1 | | -> **⚠️ Important Notice: Cache Configuration Update** |
2 | | -> |
3 | | -> We recently migrated the `autofirma-nix` repository from one of the creators' accounts to the Nix Community's organization. |
4 | | -> As part of this migration, the binary cache has also changed. To avoid unnecessary compilations in your local machine, please update your `flake.nix` configuration to use the new cache. Replace the `nixConfig` section in your `flake.nix` file with the following: |
5 | | -> |
6 | | -> ```nix |
7 | | -> nixConfig = { |
8 | | -> extra-substituters = [ |
9 | | -> "https://nix-community.cachix.org" |
10 | | -> ]; |
11 | | -> extra-trusted-public-keys = [ |
12 | | -> "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" |
13 | | -> ]; |
14 | | -> }; |
15 | | -> ``` |
16 | | -> |
17 | | -> The old cache has been be removed, so making this change promptly will ensure a seamless experience. |
18 | | -
|
19 | | -
|
20 | 1 | # autofirma-nix |
21 | 2 |
|
22 | | -This repository provides a suite of tools needed to interact with Spain’s public administration, |
23 | | -alongside NixOS and Home Manager modules for easy integration. These tools include: |
24 | | -
|
25 | | -- **AutoFirma** for digitally signing documents |
26 | | -- **DNIeRemote** for using an NFC-based national ID with an Android device as an NFC reader |
27 | | -- **Configurador FNMT-RCM** for securely requesting the personal certificate from the Spanish Royal Mint (**Fábrica Nacional de Moneda y Timbre**) |
28 | | -
|
29 | | -## Usage Example |
30 | | -
|
31 | | -```console |
32 | | -$ nix run --accept-flake-config github:nix-community/autofirma-nix#dnieremote |
33 | | -``` |
34 | | -
|
35 | | -## AutoFirma on NixOS and Home Manager |
36 | | - |
37 | | -A NixOS module is provided to enable AutoFirma on NixOS and another one for Home Manager. |
38 | | -You only need to enable one of them, depending on whether you want AutoFirma |
39 | | -system-wide or at the user level. |
40 | | - |
41 | | -### Home Manager Configuration |
42 | | - |
43 | | -The integration of AutoFirma in Home Manager enables the `autofirma` command for |
44 | | -signing PDF documents and configures the Firefox browser (if enabled through |
45 | | -`programs.firefox.enable`) to use AutoFirma on websites that require it. |
46 | | - |
47 | | -Additionally, you can enable DNIe integration, including NFC-based DNIe from an |
48 | | -Android mobile via DNIeRemote. |
49 | | - |
50 | | -`autofirma-nix` provides a Home Manager module that you should import in your Home |
51 | | -Manager configuration file. The setup may vary slightly depending on your Home |
52 | | -Manager installation method. Below are examples for a standalone configuration. |
| 3 | +[](https://builtwithnix.org) |
53 | 4 |
|
54 | | -```nix |
55 | | -# flake.nix |
| 5 | +Nix packages, NixOS modules, and Home Manager modules for the suite of tools required to interact with Spain's public administration digital services: |
56 | 6 |
|
57 | | -{ |
58 | | - inputs = { |
59 | | - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; |
| 7 | +- **AutoFirma** - Digital document signing and web authentication |
| 8 | +- **DNIeRemote** - Use your smartphone as an NFC reader for your Spanish national ID card |
| 9 | +- **Configurador FNMT-RCM** - Request and install certificates from the Spanish Royal Mint |
60 | 10 |
|
61 | | - home-manager = { |
62 | | - url = "github:nix-community/home-manager"; |
63 | | - inputs.nixpkgs.follows = "nixpkgs"; |
64 | | - }; |
| 11 | +## Quick Start |
65 | 12 |
|
66 | | - autofirma-nix = { |
67 | | - url = "github:nix-community/autofirma-nix"; # If you're tracking NixOS unstable |
68 | | - # url = "github:nix-community/autofirma-nix/release-24.11"; # If you're tracking NixOS 24.11 |
69 | | - inputs.nixpkgs.follows = "nixpkgs"; |
70 | | - }; |
71 | | - }; |
| 13 | +```bash |
| 14 | +# Run DNIeRemote directly |
| 15 | +nix run github:nix-community/autofirma-nix#dnieremote |
72 | 16 |
|
73 | | - nixConfig = { |
74 | | - extra-substituters = [ |
75 | | - "https://nix-community.cachix.org" |
76 | | - ]; |
77 | | - extra-trusted-public-keys = [ |
78 | | - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" |
79 | | - ]; |
80 | | - }; |
| 17 | +# Create a new NixOS configuration with AutoFirma |
| 18 | +nix flake new --template github:nix-community/autofirma-nix#nixos-module ./my-autofirma-system |
81 | 19 |
|
82 | | - outputs = {nixpkgs, home-manager, autofirma-nix, ...}: { |
83 | | - homeConfigurations."miusuario" = home-manager.lib.homeManagerConfiguration { |
84 | | - pkgs = nixpkgs.legacyPackages.x86_64-linux; |
85 | | -
|
86 | | - modules = [ |
87 | | - autofirma-nix.homeManagerModules.default |
88 | | - ./home.nix |
89 | | - ]; |
90 | | - }; |
91 | | - }; |
92 | | -} |
93 | | -``` |
94 | | - |
95 | | -```nix |
96 | | -# home.nix |
97 | | -{ pkgs, config, ... }: { |
98 | | - config = { |
99 | | - programs.autofirma.enable = true; |
100 | | - programs.autofirma.firefoxIntegration.profiles = { |
101 | | - myprofile = { # The name of the Firefox profile where AutoFirma will be enabled |
102 | | - enable = true; |
103 | | - }; |
104 | | - }; |
105 | | - programs.dnieremote.enable = true; |
106 | | -
|
107 | | - programs.configuradorfnmt.enable = true; |
108 | | - programs.configuradorfnmt.firefoxIntegration.profiles = { |
109 | | - myprofile = { # The name of the Firefox profile where the FNMT Configurator will be enabled |
110 | | - enable = true; |
111 | | - }; |
112 | | - }; |
113 | | -
|
114 | | - programs.firefox = { |
115 | | - enable = true; |
116 | | - policies = { |
117 | | - SecurityDevices = { |
118 | | - "OpenSC PKCS11" = "${pkgs.opensc}/lib/opensc-pkcs11.so"; # To use DNIe and other smart cards |
119 | | - "DNIeRemote" = "${config.programs.dnieremote.finalPackage}/lib/libdnieremotepkcs11.so"; # To use DNIe via NFC from an Android mobile |
120 | | - }; |
121 | | - }; |
122 | | - profiles.myprofile = { |
123 | | - id = 0; # Makes this profile the default profile |
124 | | - # ... Other configuration options for this profile |
125 | | - }; |
126 | | - }; |
127 | | - }; |
128 | | -} |
| 20 | +# Create a new Home Manager configuration with AutoFirma |
| 21 | +nix flake new --template github:nix-community/autofirma-nix#home-manager-standalone ./my-autofirma-home |
129 | 22 | ``` |
130 | 23 |
|
131 | | -### NixOS Configuration |
132 | | - |
133 | | -The AutoFirma integration in NixOS enables the `autofirma` command for signing PDF |
134 | | -documents and configures the Firefox browser (if enabled through |
135 | | -`programs.firefox.enable`) to use AutoFirma on websites that require it. |
| 24 | +## Documentation |
136 | 25 |
|
137 | | -Additionally, you can enable DNIe integration, including NFC-based DNIe from an |
138 | | -Android mobile via DNIeRemote. |
| 26 | +Comprehensive documentation is available at: |
| 27 | +https://nix-community.github.io/autofirma-nix/ |
139 | 28 |
|
140 | | -```nix |
141 | | -# flake.nix |
142 | | -
|
143 | | -{ |
144 | | - inputs = { |
145 | | - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; |
146 | | - autofirma-nix.url = "github:nix-community/autofirma-nix"; |
147 | | - # autofirma-nix.url = "github:nix-community/autofirma-nix/release-24.11"; # If you're using NixOS 24.11 |
148 | | - }; |
149 | | -
|
150 | | - outputs = { self, nixpkgs, autofirma-nix, ... }: { |
151 | | - nixosConfigurations."hostname" = nixpkgs.lib.nixosSystem { |
152 | | - system = "x86_64-linux"; |
153 | | - modules = [ |
154 | | - autofirma-nix.nixosModules.default |
155 | | - ({ pkgs, config, ... }: { |
156 | | - programs.autofirma.enable = true; |
157 | | - programs.autofirma.firefoxIntegration.enable = true; # Let Firefox use AutoFirma |
158 | | -
|
159 | | - programs.dnieremote.enable = true; |
160 | | -
|
161 | | - programs.configuradorfnmt.enable = true; |
162 | | - programs.configuradorfnmt.firefoxIntegration.enable = true; # Let Firefox use the FNMT Configurator |
163 | | -
|
164 | | - # Firefox |
165 | | - programs.firefox.enable = true; |
166 | | - programs.firefox.policies = { |
167 | | - SecurityDevices = { |
168 | | - "OpenSC PKCS#11" = "${pkgs.opensc}/lib/opensc-pkcs11.so"; # To use DNIe and other smart cards |
169 | | - "DNIeRemote" = "${config.programs.dnieremote.finalPackage}/lib/libdnieremotepkcs11.so"; # To use DNIe via NFC from an Android mobile |
170 | | - }; |
171 | | - }; |
172 | | - }) |
173 | | - ]; |
174 | | - }; |
175 | | - }; |
176 | | -} |
177 | | -``` |
| 29 | +There you'll find: |
| 30 | +- Detailed installation instructions for NixOS and Home Manager |
| 31 | +- Configuration options reference |
| 32 | +- Security considerations |
| 33 | +- Troubleshooting guide |
178 | 34 |
|
179 | | -## Managing Certificates in **autofirma-nix** |
| 35 | +## License |
180 | 36 |
|
181 | | -The Government publishes a list of authorized service providers, each offering various |
182 | | -certificates (production, development, valid, expired, etc.). For **autofirma-nix** to |
183 | | -trust a specific certificate, two conditions must be met: |
184 | | - |
185 | | -1. It must come from one of these official providers. |
186 | | -2. It must also appear in the system’s *ca-bundle* (or *cacerts*) on NixOS. |
187 | | - |
188 | | -This way, **autofirma-nix** only accepts certificates recognized by both the Government |
189 | | -and the system. If the user blocks or adds one in the NixOS configuration, those changes |
190 | | -are automatically applied to **autofirma-nix**. If a certificate is not in the local |
191 | | -*ca-bundle*, even if an official provider publishes it, **autofirma-nix** will not include |
192 | | -it. |
193 | | - |
194 | | -### Relevant NixOS Options |
195 | | - |
196 | | -The following NixOS options determine which certificates are accepted or blocked in the |
197 | | -system *truststore*, directly affecting **autofirma-nix**: |
198 | | - |
199 | | -- **`security.pki.certificateFiles`** |
200 | | - Adds additional certificates to the global *truststore*. If any match the official list, |
201 | | - **autofirma-nix** will accept them. |
202 | | - |
203 | | -- **`security.pki.caCertificateBlacklist`** |
204 | | - Blocks specific certificates. Even if they are on the official list, **autofirma-nix** will |
205 | | - exclude them if they appear in this blacklist. |
206 | | - |
207 | | -**Minimal Example**: |
208 | | -```nix |
209 | | -{ |
210 | | - security.pki = { |
211 | | - certificateFiles = [ |
212 | | - ./my-certificate.crt |
213 | | - ]; |
214 | | - caCertificateBlacklist = [ |
215 | | - "Izenpe.com" |
216 | | - ]; |
217 | | - }; |
218 | | - programs.autofirma.enable = true; |
219 | | -} |
220 | | -``` |
221 | | - |
222 | | -If `./my-certificate.crt` is on the official list, it will be included in autofirma-nix. |
223 | | -However, since `Izenpe.com` is blocked, it will be ignored even if it appears on the |
224 | | -official list. |
225 | | - |
226 | | -## Troubleshooting |
227 | | - |
228 | | -### Security devices do not seem to update or do not appear |
229 | | - |
230 | | -If you have installed AutoFirma and enabled Firefox integration, but Firefox does not |
231 | | -detect the security devices, you may need to remove the `pkcs11.txt` file from the |
232 | | -Firefox profile folder. For instance, if you enabled the Home Manager module and the |
233 | | -profile is named `myprofile`, the file is located in `~/.mozilla/firefox/myprofile/pkcs11.txt`. |
234 | | - |
235 | | -Removing it and restarting Firefox should solve the issue: |
236 | | - |
237 | | -```console |
238 | | -$ rm ~/.mozilla/firefox/myprofile/pkcs11.txt |
239 | | -$ firefox |
240 | | -``` |
241 | | - |
242 | | -### Missing certificates even though the DNIe PIN was requested |
243 | | - |
244 | | -If OpenSC PKCS#11 prompts you for a password but no certificates are available for |
245 | | -signing, you might see something like the following in the Autofirma logs (when |
246 | | -running it from a terminal): |
247 | | - |
248 | | -```console |
249 | | -$ autofirma |
250 | | -... |
251 | | -INFO: El almacen externo 'OpenSC PKCS#11' ha podido inicializarse, se anadiran sus entradas y se detiene la carga del resto de almacenes |
252 | | -... |
253 | | -INFO: Se ocultara el certificado por no estar vigente: java.security.cert.CertificateExpiredException: NotAfter: Sat Oct 26 15:03:27 GMT 2024 |
254 | | -... |
255 | | -INFO: Se ocultara el certificado por no estar vigente: java.security.cert.CertificateExpiredException: NotAfter: Sat Oct 26 15:03:27 GMT 2024 |
256 | | -... |
257 | | -SEVERE: Se genero un error en el dialogo de seleccion de certificados: java.lang.reflect.InvocationTargetException |
258 | | -.... |
259 | | -SEVERE: El almacen no contiene ningun certificado que se pueda usar para firmar: es.gob.afirma.keystores.AOCertificatesNotFoundException: No se han encontrado certificados validos en el almacen |
260 | | -``` |
261 | | - |
262 | | -This occurs because your certificates have expired, as indicated by the “NotAfter:” date. |
263 | | - |
264 | | -If the certificates are not expired because you recently renewed them, but you used |
265 | | -AutoFirma before this renewal, it is possible that OpenSC has cached your old certificates. |
266 | | -To fix this, you need to delete the OpenSC cache. [By default, it is located at |
267 | | -$HOME/.cache/opensc](https://github.com/OpenSC/OpenSC/wiki/Environment-variables). |
268 | | - |
269 | | -```console |
270 | | -$ rm -rf $HOME/.cache/opensc |
271 | | -``` |
| 37 | +This project is licensed under the MIT License - see the LICENSE file for details. |
0 commit comments