motiejus
/
config
1
Fork 0
Code Packages Releases Activity

vm: fix user propagation, refactor base.users

This commit is contained in:
Motiejus Jakštys 2024-03-06 10:33:48 +02:00
parent b31dff0451
commit f5edd23253
10 changed files with 70 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
flake.nix
View File

@ -111,30 +111,26 @@
gamja = super.callPackage ./pkgs/gamja.nix {};
})
];
mkVM = system:
nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{nixpkgs.overlays = overlays;}
./hosts/vm/configuration.nix
./modules
./modules/profiles/desktop
home-manager.nixosModules.home-manager
];
specialArgs = {inherit myData;} // inputs;
};
in
{
nixosConfigurations = {
vm-x86_64 = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
home-manager.nixosModules.home-manager
./hosts/vm/configuration.nix
./modules
];
specialArgs = {inherit myData;} // inputs;
};
vm-aarch64 = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
{nixpkgs.overlays = overlays;}
home-manager.nixosModules.home-manager
./hosts/vm/configuration.nix
./modules
];
specialArgs = {inherit myData;} // inputs;
};
vm-x86_64 = mkVM "x86_64-linux";
vm-aarch64 = mkVM "aarch64-linux";
op5p = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";

8
hosts/fra1-a/configuration.nix
View File

@ -31,13 +31,13 @@
mj = {
stateVersion = "23.05";
timeZone = "UTC";
username = "motiejus";
base = {
users = {
enable = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
unitstatus = {

7
hosts/fwminex/configuration.nix
View File

@ -56,16 +56,15 @@ in {
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
username = "motiejus";
base = {
zfs.enable = true;
users = {
enable = true;
devTools = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
snapshot = {

44
hosts/vm/configuration.nix
View File

@ -2,33 +2,24 @@
self,
lib,
pkgs,
myData,
config,
modulesPath,
...
}: {
imports = [
"${modulesPath}/profiles/all-hardware.nix"
"${modulesPath}/installer/cd-dvd/iso-image.nix"
../../modules/profiles/desktop
];
home-manager.useGlobalPkgs = true;
home-manager.users.nixos = {pkgs, ...}:
import ../../shared/home/default.nix {
inherit lib;
inherit pkgs;
inherit (config.mj) stateVersion;
username = "nixos";
devTools = true;
hmOnly = false;
email = "motiejus@jakstys.lt";
};
mj = {
stateVersion = "23.11";
timeZone = "UTC";
username = "nixos";
base.users = {
enable = true;
user.initialHashedPassword = "";
root.initialHashedPassword = "";
};
};
isoImage = {
@ -44,32 +35,15 @@
swapDevices = [];
services = {
pcscd.enable = true;
getty.autologinUser = "nixos";
xserver.enable = true;
};
users.users = {
nixos = {
isNormalUser = true;
initialHashedPassword = "";
openssh.authorizedKeys.keys = [myData.people_pubkeys.motiejus];
};
root.initialHashedPassword = "";
};
# do not autostart lightdm, leave at tty
systemd.services.display-manager.wantedBy = lib.mkForce [];
security = {
pam.services.lightdm.text = ''
auth sufficient pam_succeed_if.so user ingroup wheel
'';
sudo = {
enable = true;
wheelNeedsPassword = false;
};
};
security.pam.services.lightdm.text = ''
auth sufficient pam_succeed_if.so user ingroup wheel
'';
networking = {
hostName = "vm";

7
hosts/vno1-oh2/configuration.nix
View File

@ -38,15 +38,14 @@
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
username = "motiejus";
base = {
zfs.enable = true;
users = {
enable = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
snapshot = {

8
hosts/vno3-rp3b/configuration.nix
View File

@ -54,14 +54,14 @@
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
username = "motiejus";
base = {
zfs.enable = true;
users = {
enable = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
unitstatus = {
enable = true;

5
modules/base/default.nix
View File

@ -31,10 +31,7 @@ in {
description = "Time zone for this system";
};
username = lib.mkOption {
type = str;
default = "motiejus";
};
username = lib.mkOption {type = str;};
};
config = {

53
modules/base/users/default.nix
View File

@ -5,6 +5,25 @@
...
}: let
cfg = config.mj.base.users;
props = with lib.types; {
hashedPasswordFile = lib.mkOption {
type = nullOr path;
default = null;
};
initialPassword = lib.mkOption {
type = nullOr str;
default = null;
};
initialHashedPassword = lib.mkOption {
type = nullOr str;
default = null;
};
extraGroups = lib.mkOption {
type = listOf str;
default = [];
};
};
in {
options.mj.base.users = with lib.types; {
enable = lib.mkEnableOption "enable motiejus and root";
@ -12,25 +31,8 @@ in {
type = bool;
default = false;
};
passwd = lib.mkOption {
type = attrsOf (submodule {
options = {
hashedPasswordFile = lib.mkOption {
type = nullOr path;
default = null;
};
initialPassword = lib.mkOption {
type = nullOr str;
default = null;
};
extraGroups = lib.mkOption {
type = listOf str;
default = [];
};
};
});
};
user = props;
root = props;
};
config = lib.mkIf cfg.enable {
@ -38,10 +40,10 @@ in {
mutableUsers = false;
users = {
motiejus =
${config.mj.username} =
{
isNormalUser = true;
extraGroups = ["wheel" "dialout" "video"] ++ cfg.passwd.motiejus.extraGroups;
extraGroups = ["wheel" "dialout" "video"] ++ cfg.user.extraGroups;
uid = myData.uidgid.motiejus;
openssh.authorizedKeys.keys = [
myData.people_pubkeys.motiejus
@ -51,19 +53,18 @@ in {
n: v:
(n == "hashedPasswordFile" || n == "initialPassword") && v != null
)
cfg.passwd.motiejus or {};
cfg.user or {};
root = assert lib.assertMsg (cfg.passwd ? root) "root password needs to be defined";
lib.filterAttrs (_: v: v != null) cfg.passwd.root;
root = lib.filterAttrs (_: v: v != null) cfg.root;
};
};
home-manager.useGlobalPkgs = true;
home-manager.users.motiejus = {pkgs, ...}:
home-manager.users.${config.mj.username} = {pkgs, ...}:
import ../../../shared/home/default.nix {
inherit lib;
inherit pkgs;
inherit (config.mj) stateVersion;
inherit (config.mj) stateVersion username;
inherit (cfg) devTools;
hmOnly = false;
email = "motiejus@jakstys.lt";

2
modules/profiles/desktop/default.nix
View File

@ -23,7 +23,7 @@ in {
wireshark.enable = true;
};
mj.base.users.passwd.${username}.extraGroups = ["adbusers" "networkmanager" "wireshark"];
mj.base.users.user.extraGroups = ["adbusers" "networkmanager" "wireshark"];
services = {
fwupd.enable = true;

2
shared/home/default.nix
View File

@ -5,7 +5,7 @@
email,
devTools,
hmOnly,
username ? "motiejus",
username,
...
}: let
# from https://github.com/Gerg-L/demoninajar/blob/39964f198dbfa34c21f81c35370fab312b476051/homes/veritas_manjaro/nixGL.nix#L42