steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

update commonUsers and refactor system config

Browse source
This commit is contained in:
steveej 2024-01-22 22:45:42 +00:00
parent a1f42a13a1
commit 3b7a80ef03
8 changed files with 131 additions and 104 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nix/os/devices/steveej-t14/system.nix
View file

@ -6,8 +6,6 @@
, ... , ...
}: }:
let let
passwords = import ../../../variables/passwords.crypt.nix;
localTcpPorts = [ localTcpPorts = [
22 22
@ -30,6 +28,7 @@ in
../../snippets/nix-settings-holo-chain.nix ../../snippets/nix-settings-holo-chain.nix
../../snippets/radicale.nix ../../snippets/radicale.nix
../../snippets/sway-desktop.nix ../../snippets/sway-desktop.nix
../../snippets/timezone.nix
]; ];
nix.settings = { nix.settings = {
@ -64,6 +63,8 @@ in
} }
]; ];
networking.networkmanager.enable = true;
networking.extraHosts = '' networking.extraHosts = ''
''; '';
@ -122,8 +123,6 @@ in
services.xserver.videoDrivers = lib.mkForce [ "amdgpu" ]; services.xserver.videoDrivers = lib.mkForce [ "amdgpu" ];
time.timeZone = lib.mkForce passwords.timeZone.stefan;
hardware.ledger.enable = true; hardware.ledger.enable = true;
# services.zerotierone = { # services.zerotierone = {

21
nix/os/devices/steveej-t14/user.nix
View file

@ -1,19 +1,20 @@
{ { config
config, , pkgs
pkgs, , lib
lib, , ...
... }:
}: let let
keys = import ../../../variables/keys.nix; keys = import ../../../variables/keys.nix;
inherit (pkgs.callPackage ../../lib/default.nix {}) mkUser; inherit (pkgs.callPackage ../../lib/default.nix { }) mkUser;
in { in
{
users.extraUsers.steveej2 = mkUser { users.extraUsers.steveej2 = mkUser {
uid = 1001; uid = 1001;
openssh.authorizedKeys.keys = keys.users.steveej.openssh; openssh.authorizedKeys.keys = keys.users.steveej.openssh;
passwordFile = config.sops.secrets.sharedUsers-steveej.path; hashedPasswordFile = config.sops.secrets.sharedUsers-steveej.path;
}; };
nix.settings.trusted-users = ["steveej"]; nix.settings.trusted-users = [ "steveej" ];
security.pam.u2f.enable = true; security.pam.u2f.enable = true;
security.pam.services.steveej.u2fAuth = true; security.pam.services.steveej.u2fAuth = true;

22
nix/os/devices/steveej-x13s/configuration.nix
View file

@ -45,12 +45,11 @@
# sops.defaultSopsFile = ../../../../secrets/${nodeName}/secrets.yaml; # sops.defaultSopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
# sops.defaultSopsFormat = "yaml"; # sops.defaultSopsFormat = "yaml";
# users.commonUsers = { users.commonUsers = {
# enable = true; enable = true;
# enableNonRoot = true; enableNonRoot = true;
# }; installPassword = "install";
};
users.users.root.initialPassword = "install";
} }
nodeFlake.inputs.home-manager.nixosModules.home-manager nodeFlake.inputs.home-manager.nixosModules.home-manager
@ -66,14 +65,9 @@
bluetoothMac = "65:9e:7a:8b:86:28"; bluetoothMac = "65:9e:7a:8b:86:28";
}; };
networking = { networking.hostName = nodeName;
hostName = nodeName; networking.firewall.enable = true;
networking.networkmanager.enable = true;
firewall.enable = true;
# useNetworkd = true;
};
nixpkgs.config.allowUnfree = true; nixpkgs.config.allowUnfree = true;

55
nix/os/lib/default.nix
View file

@ -6,35 +6,34 @@ let
keys = import ../../variables/keys.nix; keys = import ../../variables/keys.nix;
in in
{ {
mkUser = args: ( mkUser = args: lib.mkMerge [
lib.attrsets.recursiveUpdate {
{ isNormalUser = true;
isNormalUser = true; extraGroups = [
extraGroups = [ "docker"
"docker" "wheel"
"wheel" "libvirtd"
"libvirtd" "networkmanager"
"networkmanager" "vboxusers"
"vboxusers" "users"
"users" "input"
"input" "audio"
"audio" "video"
"video" "cdrom"
"cdrom" "adbusers"
"adbusers" "dialout"
"dialout" "cdrom"
"cdrom" "fuse"
"fuse" ];
]; openssh.authorizedKeys.keys = keys.users.steveej.openssh;
openssh.authorizedKeys.keys = keys.users.steveej.openssh;
# TODO: investigate why this secret cannot be found # TODO: investigate why this secret cannot be found
# openssh.authorizedKeys.keyFiles = [ # openssh.authorizedKeys.keyFiles = [
# config.sops.secrets.sharedSshKeys-steveej.path # config.sops.secrets.sharedSshKeys-steveej.path
# ]; # ];
} }
args args
); ];
disk = rec { disk = rec {
# TODO: verify the GPT PARTLABEL cap at 36 chars # TODO: verify the GPT PARTLABEL cap at 36 chars

17
nix/os/profiles/common/system.nix
View file

@ -1,9 +1,8 @@
{ { config
config, , pkgs
pkgs, , lib
lib, , nodeName
nodeName, , ...
...
}: { }: {
networking.hostName = builtins.elemAt (builtins.split "\\." nodeName) 0; # Define your hostname. networking.hostName = builtins.elemAt (builtins.split "\\." nodeName) 0; # Define your hostname.
networking.domain = builtins.elemAt (builtins.split "(^[^\\.]+\.)" nodeName) 2; networking.domain = builtins.elemAt (builtins.split "(^[^\\.]+\.)" nodeName) 2;
@ -15,11 +14,11 @@
''; '';
# Fonts, I18N, Date ... # Fonts, I18N, Date ...
fonts.fonts = [pkgs.corefonts]; fonts.packages = [ pkgs.corefonts ];
console.font = "lat9w-16"; console.font = "lat9w-16";
i18n = {defaultLocale = "en_US.UTF-8";}; i18n = { defaultLocale = "en_US.UTF-8"; };
time.timeZone = "Etc/UTC"; time.timeZone = "Etc/UTC";
services.gpm.enable = true; services.gpm.enable = true;
@ -52,6 +51,6 @@
programs.zsh.enable = true; programs.zsh.enable = true;
users.defaultUserShell = pkgs.zsh; users.defaultUserShell = pkgs.zsh;
environment.pathsToLink = ["/share/zsh"]; environment.pathsToLink = [ "/share/zsh" ];
programs.fuse.userAllowOther = true; programs.fuse.userAllowOther = true;
} }

98
nix/os/profiles/common/user.nix
View file

@ -1,9 +1,9 @@
{ { config
config, , pkgs
pkgs, , lib
lib, , ...
... }:
}: let let
keys = import ../../../variables/keys.nix; keys = import ../../../variables/keys.nix;
inherit inherit
(import ../../lib/default.nix { (import ../../lib/default.nix {
@ -16,7 +16,8 @@
inherit (lib) types; inherit (lib) types;
cfg = config.users.commonUsers; cfg = config.users.commonUsers;
in { in
{
options.users.commonUsers = { options.users.commonUsers = {
enable = lib.mkOption { enable = lib.mkOption {
default = true; default = true;
@ -32,41 +33,64 @@ in {
default = config.sops.secrets.sharedUsers-root.path; default = config.sops.secrets.sharedUsers-root.path;
type = types.path; type = types.path;
}; };
installPassword = lib.mkOption {
default = "";
type = types.str;
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable (lib.mkMerge [
sops.secrets.sharedUsers-root = { (lib.mkIf (cfg.installPassword == "") {
sopsFile = ../../../../secrets/shared-users.yaml; sops.secrets.sharedUsers-root = {
neededForUsers = true; sopsFile = ../../../../secrets/shared-users.yaml;
format = "yaml"; neededForUsers = true;
}; format = "yaml";
};
sops.secrets.sharedUsers-steveej = lib.mkIf cfg.enableNonRoot { sops.secrets.sharedUsers-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml; sopsFile = ../../../../secrets/shared-users.yaml;
neededForUsers = true; neededForUsers = true;
format = "yaml"; format = "yaml";
}; };
sops.secrets.sharedSshKeys-steveej = lib.mkIf cfg.enableNonRoot { sops.secrets.sharedSshKeys-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml; sopsFile = ../../../../secrets/shared-users.yaml;
# neededForUsers = true; # neededForUsers = true;
format = "yaml"; format = "yaml";
}; };
})
users.mutableUsers = lib.mkForce false; {
users.mutableUsers = lib.mkForce false;
users.extraUsers.root = { users.users.root = lib.mkMerge [
passwordFile = cfg.rootPasswordFile; {
openssh.authorizedKeys.keys = keys.users.steveej.openssh; openssh.authorizedKeys.keys = keys.users.steveej.openssh;
}
# TODO: investigate why this secret cannot be found (lib.mkIf (cfg.installPassword != "") {
# openssh.authorizedKeys.keyFiles = [ password = cfg.installPassword;
# config.sops.secrets.sharedSshKeys-steveej.path })
# ];
};
users.extraUsers.steveej = lib.mkIf cfg.enableNonRoot (mkUser { (lib.mkIf (cfg.installPassword == "") {
uid = 1000; hashedPasswordFile = cfg.rootPasswordFile;
passwordFile = config.sops.secrets.sharedUsers-steveej.path; })
}); ];
};
users.users.steveej = lib.mkIf cfg.enableNonRoot (mkUser (lib.mkMerge [
{
uid = 1000;
}
(lib.mkIf (cfg.installPassword != "") {
password = cfg.installPassword;
})
(lib.mkIf (cfg.installPassword == "") {
hashedPasswordFile = config.sops.secrets.sharedUsers-steveej.path;
})
]));
}
]);
} }

6
nix/os/snippets/sway-desktop.nix
View file

@ -35,6 +35,10 @@ in
# $ xdg-open "https://github.com/" # $ xdg-open "https://github.com/"
# Error: GDBus.Error:org.freedesktop.DBus.Error.UnknownMethod: No such interface “org.freedesktop.portal.OpenURI” on object at path /org/freedesktop/portal/desktop # Error: GDBus.Error:org.freedesktop.DBus.Error.UnknownMethod: No such interface “org.freedesktop.portal.OpenURI” on object at path /org/freedesktop/portal/desktop
xdgOpenUsePortal = false; xdgOpenUsePortal = false;
# keep the behaviour in < 1.17, which uses the first portal implementation found in lexicographical order, use the following:
config.common.default = "*";
extraPortals = [ extraPortals = [
pkgs.xdg-desktop-portal-wlr pkgs.xdg-desktop-portal-wlr
pkgs.xdg-desktop-portal-gtk pkgs.xdg-desktop-portal-gtk
@ -59,8 +63,6 @@ in
#jack.enable = true; #jack.enable = true;
}; };
networkmanager.enable = false;
security.pam.services.getty.enableGnomeKeyring = true; security.pam.services.getty.enableGnomeKeyring = true;
services.gnome.gnome-keyring.enable = true; services.gnome.gnome-keyring.enable = true;
# autologin steveej on tty1 # autologin steveej on tty1

9
nix/os/snippets/timezone.nix Normal file
View file

@ -0,0 +1,9 @@
{ lib, ... }:
let
passwords = import ../../../variables/passwords.crypt.nix;
in
{
time.timeZone = lib.mkDefault passwords.timeZone.stefan;
}