One thing I haven't solved yet is the named pipes created in /var/run/cato-sdp.* are owned by root, they should probably be owned by a new cato group, so users don't need to run cato-sdp with root, or manually chown the pipes.
Suggestions welcome, nay, pleaded for.

One thing I haven't solved yet is the named pipes created in /var/run/cato-sdp.* are owned by root, they should probably be owned by a new cato group, so users don't need to run cato-sdp with root, or manually chown the pipes. Suggestions welcome, nay, pleaded for.

For this I'd encourage writing a module that can leverage either some kind of systemd unit or systemd.tmpfiles to ensure proper permissions are set.

EDIT: Since I see there is a systemd service, set User=<USER> and write a nixos module to create this user. You can find multiple examples of such behavior in many nixos modules.

One thing I haven't solved yet is the named pipes created in /var/run/cato-sdp.* are owned by root, they should probably be owned by a new cato group, so users don't need to run cato-sdp with root, or manually chown the pipes. Suggestions welcome, nay, pleaded for.

For this I'd encourage writing a module that can leverage either some kind of systemd unit or systemd.tmpfiles to ensure proper permissions are set.

EDIT: Since I see there is a systemd service, set User=<USER> and write a nixos module to create this user. You can find multiple examples of such behavior in many nixos modules.

I have created a module. Tried to start the service with User=cato-client, but it needs permissions for /var/log/cato-client.log as well as to create the socket files in /var/run/. I don't have a way of overriding that, the service doesn't seem to have any options. I'd be cool if I could just run the whole think inside a fake /, but I'm not fussed having it running as root for now.

Are the paths correct now that it's a module? I notice that If I include it like this in my /etc/nixos/configuration.nix it doesn't install the other binary that I need, cato-sdp to enable the tunnel, and login with an account:

{ config, lib, pkgs, ... }:

{
  imports = [ /home/yarek/Play/nixpkgs/pkgs/by-name/ca/cato-client/package.nix ];

  services.cato-client.enable = true;
  # ...
}

Should I have a line that installs it into systemPackages somewhere inside the cfg.enable bit?

Now this looks better:

{ config, lib, pkgs, ... }:

{
  imports = [/home/yarek/Play/nixpkgs/nixos/modules/services/networking/cato-client.nix ];

  services.cato-client = {
    enable = true;
    package = (pkgs.callPackage /home/yarek/Play/nixpkgs/pkgs/by-name/ca/cato-client/package.nix {});
  };