vm: fix user propagation, refactor base.users

flake.nix

@@ -111,30 +111,26 @@
         gamja = super.callPackage ./pkgs/gamja.nix {};
       })
     ];
+
+    mkVM = system:
+      nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          {nixpkgs.overlays = overlays;}
+          ./hosts/vm/configuration.nix
+
+          ./modules
+          ./modules/profiles/desktop
+
+          home-manager.nixosModules.home-manager
+        ];
+        specialArgs = {inherit myData;} // inputs;
+      };
   in
     {
       nixosConfigurations = {
-        vm-x86_64 = nixpkgs.lib.nixosSystem {
+        vm-x86_64 = mkVM "x86_64-linux";
-          system = "x86_64-linux";
+        vm-aarch64 = mkVM "aarch64-linux";
-          modules = [
-            {nixpkgs.overlays = overlays;}
-            home-manager.nixosModules.home-manager
-            ./hosts/vm/configuration.nix
-            ./modules
-          ];
-          specialArgs = {inherit myData;} // inputs;
-        };
-
-        vm-aarch64 = nixpkgs.lib.nixosSystem {
-          system = "aarch64-linux";
-          modules = [
-            {nixpkgs.overlays = overlays;}
-            home-manager.nixosModules.home-manager
-            ./hosts/vm/configuration.nix
-            ./modules
-          ];
-          specialArgs = {inherit myData;} // inputs;
-        };
 
         op5p = nixpkgs.lib.nixosSystem {
           system = "aarch64-linux";

hosts/fra1-a/configuration.nix

@@ -31,13 +31,13 @@
   mj = {
     stateVersion = "23.05";
     timeZone = "UTC";
+    username = "motiejus";
+
     base = {
       users = {
         enable = true;
-        passwd = {
+        root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
-          root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
+        user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-          motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-        };
       };
 
       unitstatus = {

hosts/fwminex/configuration.nix

@@ -56,16 +56,15 @@ in {
   mj = {
     stateVersion = "23.05";
     timeZone = "Europe/Vilnius";
+    username = "motiejus";
 
     base = {
       zfs.enable = true;
       users = {
         enable = true;
         devTools = true;
-        passwd = {
+        root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
-          root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
+        user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-          motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-        };
       };
 
       snapshot = {

hosts/vm/configuration.nix

@@ -2,33 +2,24 @@
   self,
   lib,
   pkgs,
-  myData,
-  config,
   modulesPath,
   ...
 }: {
   imports = [
     "${modulesPath}/profiles/all-hardware.nix"
     "${modulesPath}/installer/cd-dvd/iso-image.nix"
-    ../../modules/profiles/desktop
   ];
 
-  home-manager.useGlobalPkgs = true;
-  home-manager.users.nixos = {pkgs, ...}:
-    import ../../shared/home/default.nix {
-      inherit lib;
-      inherit pkgs;
-      inherit (config.mj) stateVersion;
-      username = "nixos";
-      devTools = true;
-      hmOnly = false;
-      email = "motiejus@jakstys.lt";
-    };
-
   mj = {
     stateVersion = "23.11";
     timeZone = "UTC";
     username = "nixos";
+
+    base.users = {
+      enable = true;
+      user.initialHashedPassword = "";
+      root.initialHashedPassword = "";
+    };
   };
 
   isoImage = {
@@ -44,32 +35,15 @@
   swapDevices = [];
 
   services = {
-    pcscd.enable = true;
     getty.autologinUser = "nixos";
-    xserver.enable = true;
-  };
-
-  users.users = {
-    nixos = {
-      isNormalUser = true;
-      initialHashedPassword = "";
-      openssh.authorizedKeys.keys = [myData.people_pubkeys.motiejus];
-    };
-    root.initialHashedPassword = "";
   };
 
   # do not autostart lightdm, leave at tty
   systemd.services.display-manager.wantedBy = lib.mkForce [];
 
-  security = {
+  security.pam.services.lightdm.text = ''
-    pam.services.lightdm.text = ''
+    auth sufficient pam_succeed_if.so user ingroup wheel
-      auth sufficient pam_succeed_if.so user ingroup wheel
+  '';
-    '';
-    sudo = {
-      enable = true;
-      wheelNeedsPassword = false;
-    };
-  };
 
   networking = {
     hostName = "vm";

hosts/vno1-oh2/configuration.nix

@@ -38,15 +38,14 @@
   mj = {
     stateVersion = "23.05";
     timeZone = "Europe/Vilnius";
+    username = "motiejus";
 
     base = {
       zfs.enable = true;
       users = {
         enable = true;
-        passwd = {
+        root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
-          root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
+        user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-          motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-        };
       };
 
       snapshot = {

hosts/vno3-rp3b/configuration.nix

@@ -54,14 +54,14 @@
   mj = {
     stateVersion = "23.05";
     timeZone = "Europe/Vilnius";
+    username = "motiejus";
+
     base = {
       zfs.enable = true;
       users = {
         enable = true;
-        passwd = {
+        root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
-          root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
+        user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-          motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
-        };
       };
       unitstatus = {
         enable = true;

modules/base/default.nix

@@ -31,10 +31,7 @@ in {
       description = "Time zone for this system";
     };
 
-    username = lib.mkOption {
+    username = lib.mkOption {type = str;};
-      type = str;
-      default = "motiejus";
-    };
   };
 
   config = {

modules/base/users/default.nix

@@ -5,6 +5,25 @@
   ...
 }: let
   cfg = config.mj.base.users;
+  props = with lib.types; {
+    hashedPasswordFile = lib.mkOption {
+      type = nullOr path;
+      default = null;
+    };
+    initialPassword = lib.mkOption {
+      type = nullOr str;
+      default = null;
+    };
+    initialHashedPassword = lib.mkOption {
+      type = nullOr str;
+      default = null;
+    };
+
+    extraGroups = lib.mkOption {
+      type = listOf str;
+      default = [];
+    };
+  };
 in {
   options.mj.base.users = with lib.types; {
     enable = lib.mkEnableOption "enable motiejus and root";
@@ -12,25 +31,8 @@ in {
       type = bool;
       default = false;
     };
-    passwd = lib.mkOption {
+    user = props;
-      type = attrsOf (submodule {
+    root = props;
-        options = {
-          hashedPasswordFile = lib.mkOption {
-            type = nullOr path;
-            default = null;
-          };
-          initialPassword = lib.mkOption {
-            type = nullOr str;
-            default = null;
-          };
-
-          extraGroups = lib.mkOption {
-            type = listOf str;
-            default = [];
-          };
-        };
-      });
-    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -38,10 +40,10 @@ in {
       mutableUsers = false;
 
       users = {
-        motiejus =
+        ${config.mj.username} =
           {
             isNormalUser = true;
-            extraGroups = ["wheel" "dialout" "video"] ++ cfg.passwd.motiejus.extraGroups;
+            extraGroups = ["wheel" "dialout" "video"] ++ cfg.user.extraGroups;
             uid = myData.uidgid.motiejus;
             openssh.authorizedKeys.keys = [
               myData.people_pubkeys.motiejus
@@ -51,19 +53,18 @@ in {
             n: v:
               (n == "hashedPasswordFile" || n == "initialPassword") && v != null
           )
-          cfg.passwd.motiejus or {};
+          cfg.user or {};
 
-        root = assert lib.assertMsg (cfg.passwd ? root) "root password needs to be defined";
+        root = lib.filterAttrs (_: v: v != null) cfg.root;
-          lib.filterAttrs (_: v: v != null) cfg.passwd.root;
       };
     };
 
     home-manager.useGlobalPkgs = true;
-    home-manager.users.motiejus = {pkgs, ...}:
+    home-manager.users.${config.mj.username} = {pkgs, ...}:
       import ../../../shared/home/default.nix {
         inherit lib;
         inherit pkgs;
-        inherit (config.mj) stateVersion;
+        inherit (config.mj) stateVersion username;
         inherit (cfg) devTools;
         hmOnly = false;
         email = "motiejus@jakstys.lt";

modules/profiles/desktop/default.nix

@@ -23,7 +23,7 @@ in {
       wireshark.enable = true;
     };
 
-    mj.base.users.passwd.${username}.extraGroups = ["adbusers" "networkmanager" "wireshark"];
+    mj.base.users.user.extraGroups = ["adbusers" "networkmanager" "wireshark"];
 
     services = {
       fwupd.enable = true;

shared/home/default.nix

@@ -5,7 +5,7 @@
   email,
   devTools,
   hmOnly,
-  username ? "motiejus",
+  username,
   ...
 }: let
   # from https://github.com/Gerg-L/demoninajar/blob/39964f198dbfa34c21f81c35370fab312b476051/homes/veritas_manjaro/nixGL.nix#L42