vm: fix user propagation, refactor base.users

This commit is contained in:
Motiejus Jakštys 2024-03-06 10:33:48 +02:00
parent b31dff0451
commit f5edd23253
10 changed files with 70 additions and 104 deletions

View File

@ -111,30 +111,26 @@
gamja = super.callPackage ./pkgs/gamja.nix {};
})
];
mkVM = system:
nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{nixpkgs.overlays = overlays;}
./hosts/vm/configuration.nix
./modules
./modules/profiles/desktop
home-manager.nixosModules.home-manager
];
specialArgs = {inherit myData;} // inputs;
};
in
{
nixosConfigurations = {
vm-x86_64 = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
home-manager.nixosModules.home-manager
./hosts/vm/configuration.nix
./modules
];
specialArgs = {inherit myData;} // inputs;
};
vm-aarch64 = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
{nixpkgs.overlays = overlays;}
home-manager.nixosModules.home-manager
./hosts/vm/configuration.nix
./modules
];
specialArgs = {inherit myData;} // inputs;
};
vm-x86_64 = mkVM "x86_64-linux";
vm-aarch64 = mkVM "aarch64-linux";
op5p = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";

View File

@ -31,13 +31,13 @@
mj = {
stateVersion = "23.05";
timeZone = "UTC";
username = "motiejus";
base = {
users = {
enable = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
unitstatus = {

View File

@ -56,16 +56,15 @@ in {
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
username = "motiejus";
base = {
zfs.enable = true;
users = {
enable = true;
devTools = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
snapshot = {

View File

@ -2,33 +2,24 @@
self,
lib,
pkgs,
myData,
config,
modulesPath,
...
}: {
imports = [
"${modulesPath}/profiles/all-hardware.nix"
"${modulesPath}/installer/cd-dvd/iso-image.nix"
../../modules/profiles/desktop
];
home-manager.useGlobalPkgs = true;
home-manager.users.nixos = {pkgs, ...}:
import ../../shared/home/default.nix {
inherit lib;
inherit pkgs;
inherit (config.mj) stateVersion;
username = "nixos";
devTools = true;
hmOnly = false;
email = "motiejus@jakstys.lt";
};
mj = {
stateVersion = "23.11";
timeZone = "UTC";
username = "nixos";
base.users = {
enable = true;
user.initialHashedPassword = "";
root.initialHashedPassword = "";
};
};
isoImage = {
@ -44,32 +35,15 @@
swapDevices = [];
services = {
pcscd.enable = true;
getty.autologinUser = "nixos";
xserver.enable = true;
};
users.users = {
nixos = {
isNormalUser = true;
initialHashedPassword = "";
openssh.authorizedKeys.keys = [myData.people_pubkeys.motiejus];
};
root.initialHashedPassword = "";
};
# do not autostart lightdm, leave at tty
systemd.services.display-manager.wantedBy = lib.mkForce [];
security = {
pam.services.lightdm.text = ''
security.pam.services.lightdm.text = ''
auth sufficient pam_succeed_if.so user ingroup wheel
'';
sudo = {
enable = true;
wheelNeedsPassword = false;
};
};
networking = {
hostName = "vm";

View File

@ -38,15 +38,14 @@
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
username = "motiejus";
base = {
zfs.enable = true;
users = {
enable = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
snapshot = {

View File

@ -54,14 +54,14 @@
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
username = "motiejus";
base = {
zfs.enable = true;
users = {
enable = true;
passwd = {
root.hashedPasswordFile = config.age.secrets.root-passwd-hash.path;
motiejus.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
user.hashedPasswordFile = config.age.secrets.motiejus-passwd-hash.path;
};
unitstatus = {
enable = true;

View File

@ -31,10 +31,7 @@ in {
description = "Time zone for this system";
};
username = lib.mkOption {
type = str;
default = "motiejus";
};
username = lib.mkOption {type = str;};
};
config = {

View File

@ -5,16 +5,7 @@
...
}: let
cfg = config.mj.base.users;
in {
options.mj.base.users = with lib.types; {
enable = lib.mkEnableOption "enable motiejus and root";
devTools = lib.mkOption {
type = bool;
default = false;
};
passwd = lib.mkOption {
type = attrsOf (submodule {
options = {
props = with lib.types; {
hashedPasswordFile = lib.mkOption {
type = nullOr path;
default = null;
@ -23,14 +14,25 @@ in {
type = nullOr str;
default = null;
};
initialHashedPassword = lib.mkOption {
type = nullOr str;
default = null;
};
extraGroups = lib.mkOption {
type = listOf str;
default = [];
};
};
});
in {
options.mj.base.users = with lib.types; {
enable = lib.mkEnableOption "enable motiejus and root";
devTools = lib.mkOption {
type = bool;
default = false;
};
user = props;
root = props;
};
config = lib.mkIf cfg.enable {
@ -38,10 +40,10 @@ in {
mutableUsers = false;
users = {
motiejus =
${config.mj.username} =
{
isNormalUser = true;
extraGroups = ["wheel" "dialout" "video"] ++ cfg.passwd.motiejus.extraGroups;
extraGroups = ["wheel" "dialout" "video"] ++ cfg.user.extraGroups;
uid = myData.uidgid.motiejus;
openssh.authorizedKeys.keys = [
myData.people_pubkeys.motiejus
@ -51,19 +53,18 @@ in {
n: v:
(n == "hashedPasswordFile" || n == "initialPassword") && v != null
)
cfg.passwd.motiejus or {};
cfg.user or {};
root = assert lib.assertMsg (cfg.passwd ? root) "root password needs to be defined";
lib.filterAttrs (_: v: v != null) cfg.passwd.root;
root = lib.filterAttrs (_: v: v != null) cfg.root;
};
};
home-manager.useGlobalPkgs = true;
home-manager.users.motiejus = {pkgs, ...}:
home-manager.users.${config.mj.username} = {pkgs, ...}:
import ../../../shared/home/default.nix {
inherit lib;
inherit pkgs;
inherit (config.mj) stateVersion;
inherit (config.mj) stateVersion username;
inherit (cfg) devTools;
hmOnly = false;
email = "motiejus@jakstys.lt";

View File

@ -23,7 +23,7 @@ in {
wireshark.enable = true;
};
mj.base.users.passwd.${username}.extraGroups = ["adbusers" "networkmanager" "wireshark"];
mj.base.users.user.extraGroups = ["adbusers" "networkmanager" "wireshark"];
services = {
fwupd.enable = true;

View File

@ -5,7 +5,7 @@
email,
devTools,
hmOnly,
username ? "motiejus",
username,
...
}: let
# from https://github.com/Gerg-L/demoninajar/blob/39964f198dbfa34c21f81c35370fab312b476051/homes/veritas_manjaro/nixGL.nix#L42