steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

update commonUsers and refactor system config

Browse source
This commit is contained in:
steveej 2024-01-22 22:45:42 +00:00
parent a1f42a13a1
commit 3b7a80ef03
8 changed files with 131 additions and 104 deletions
Download patch file Download diff file Expand all files Collapse all files

98
nix/os/profiles/common/user.nix
View file

@ -1,9 +1,9 @@
{
config,
pkgs,
lib,
...
}: let
{ config
, pkgs
, lib
, ...
}:
let
keys = import ../../../variables/keys.nix;
inherit
(import ../../lib/default.nix {
@ -16,7 +16,8 @@
inherit (lib) types;
cfg = config.users.commonUsers;
in {
in
{
options.users.commonUsers = {
enable = lib.mkOption {
default = true;
@ -32,41 +33,64 @@ in {
default = config.sops.secrets.sharedUsers-root.path;
type = types.path;
};
installPassword = lib.mkOption {
default = "";
type = types.str;
};
};
config = lib.mkIf cfg.enable {
sops.secrets.sharedUsers-root = {
sopsFile = ../../../../secrets/shared-users.yaml;
neededForUsers = true;
format = "yaml";
};
config = lib.mkIf cfg.enable (lib.mkMerge [
(lib.mkIf (cfg.installPassword == "") {
sops.secrets.sharedUsers-root = {
sopsFile = ../../../../secrets/shared-users.yaml;
neededForUsers = true;
format = "yaml";
};
sops.secrets.sharedUsers-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml;
neededForUsers = true;
format = "yaml";
};
sops.secrets.sharedUsers-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml;
neededForUsers = true;
format = "yaml";
};
sops.secrets.sharedSshKeys-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml;
# neededForUsers = true;
format = "yaml";
};
sops.secrets.sharedSshKeys-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml;
# neededForUsers = true;
format = "yaml";
};
})
users.mutableUsers = lib.mkForce false;
{
users.mutableUsers = lib.mkForce false;
users.extraUsers.root = {
passwordFile = cfg.rootPasswordFile;
openssh.authorizedKeys.keys = keys.users.steveej.openssh;
users.users.root = lib.mkMerge [
{
openssh.authorizedKeys.keys = keys.users.steveej.openssh;
}
# TODO: investigate why this secret cannot be found
# openssh.authorizedKeys.keyFiles = [
# config.sops.secrets.sharedSshKeys-steveej.path
# ];
};
(lib.mkIf (cfg.installPassword != "") {
password = cfg.installPassword;
})
users.extraUsers.steveej = lib.mkIf cfg.enableNonRoot (mkUser {
uid = 1000;
passwordFile = config.sops.secrets.sharedUsers-steveej.path;
});
};
(lib.mkIf (cfg.installPassword == "") {
hashedPasswordFile = cfg.rootPasswordFile;
})
];
users.users.steveej = lib.mkIf cfg.enableNonRoot (mkUser (lib.mkMerge [
{
uid = 1000;
}
(lib.mkIf (cfg.installPassword != "") {
password = cfg.installPassword;
})
(lib.mkIf (cfg.installPassword == "") {
hashedPasswordFile = config.sops.secrets.sharedUsers-steveej.path;
})
]));
}
]);
}