update commonUsers and refactor system config

nix/os/devices/steveej-t14/system.nix

@@ -6,8 +6,6 @@
 , ...
 }:
 let
-  passwords = import ../../../variables/passwords.crypt.nix;
-
   localTcpPorts = [
     22
 
@@ -30,6 +28,7 @@ in
     ../../snippets/nix-settings-holo-chain.nix
     ../../snippets/radicale.nix
     ../../snippets/sway-desktop.nix
+    ../../snippets/timezone.nix
   ];
 
   nix.settings = {
@@ -64,6 +63,8 @@ in
     }
   ];
 
+  networking.networkmanager.enable = true;
+
   networking.extraHosts = ''
   '';
 
@@ -122,8 +123,6 @@ in
 
   services.xserver.videoDrivers = lib.mkForce [ "amdgpu" ];
 
-  time.timeZone = lib.mkForce passwords.timeZone.stefan;
-
   hardware.ledger.enable = true;
 
   # services.zerotierone = {

nix/os/devices/steveej-t14/user.nix

@@ -1,19 +1,20 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{ config
+, pkgs
+, lib
+, ...
+}:
+let
   keys = import ../../../variables/keys.nix;
-  inherit (pkgs.callPackage ../../lib/default.nix {}) mkUser;
-in {
+  inherit (pkgs.callPackage ../../lib/default.nix { }) mkUser;
+in
+{
   users.extraUsers.steveej2 = mkUser {
     uid = 1001;
     openssh.authorizedKeys.keys = keys.users.steveej.openssh;
-    passwordFile = config.sops.secrets.sharedUsers-steveej.path;
+    hashedPasswordFile = config.sops.secrets.sharedUsers-steveej.path;
   };
 
-  nix.settings.trusted-users = ["steveej"];
+  nix.settings.trusted-users = [ "steveej" ];
 
   security.pam.u2f.enable = true;
   security.pam.services.steveej.u2fAuth = true;

nix/os/devices/steveej-x13s/configuration.nix

@@ -45,12 +45,11 @@
       # sops.defaultSopsFile = ../../../../secrets/${nodeName}/secrets.yaml;
       # sops.defaultSopsFormat = "yaml";
 
-      # users.commonUsers = {
-      #   enable = true;
-      #   enableNonRoot = true;
-      # };
-
-      users.users.root.initialPassword = "install";
+      users.commonUsers = {
+        enable = true;
+        enableNonRoot = true;
+        installPassword = "install";
+      };
     }
 
     nodeFlake.inputs.home-manager.nixosModules.home-manager
@@ -66,14 +65,9 @@
     bluetoothMac = "65:9e:7a:8b:86:28";
   };
 
-  networking = {
-    hostName = nodeName;
-
-    firewall.enable = true;
-
-    # useNetworkd = true;
-  };
-
+  networking.hostName = nodeName;
+  networking.firewall.enable = true;
+  networking.networkmanager.enable = true;
 
   nixpkgs.config.allowUnfree = true;
 

nix/os/lib/default.nix

@@ -6,8 +6,7 @@ let
   keys = import ../../variables/keys.nix;
 in
 {
-  mkUser = args: (
-    lib.attrsets.recursiveUpdate
+  mkUser = args: lib.mkMerge [
     {
       isNormalUser = true;
       extraGroups = [
@@ -34,7 +33,7 @@ in
       # ];
     }
     args
-  );
+  ];
 
   disk = rec {
     # TODO: verify the GPT PARTLABEL cap at 36 chars

nix/os/profiles/common/system.nix

@@ -1,9 +1,8 @@
-{
-  config,
-  pkgs,
-  lib,
-  nodeName,
-  ...
+{ config
+, pkgs
+, lib
+, nodeName
+, ...
 }: {
   networking.hostName = builtins.elemAt (builtins.split "\\." nodeName) 0; # Define your hostname.
   networking.domain = builtins.elemAt (builtins.split "(^[^\\.]+\.)" nodeName) 2;
@@ -15,11 +14,11 @@
   '';
 
   # Fonts, I18N, Date ...
-  fonts.fonts = [pkgs.corefonts];
+  fonts.packages = [ pkgs.corefonts ];
 
   console.font = "lat9w-16";
 
-  i18n = {defaultLocale = "en_US.UTF-8";};
+  i18n = { defaultLocale = "en_US.UTF-8"; };
   time.timeZone = "Etc/UTC";
   services.gpm.enable = true;
 
@@ -52,6 +51,6 @@
 
   programs.zsh.enable = true;
   users.defaultUserShell = pkgs.zsh;
-  environment.pathsToLink = ["/share/zsh"];
+  environment.pathsToLink = [ "/share/zsh" ];
   programs.fuse.userAllowOther = true;
 }

nix/os/profiles/common/user.nix

@@ -1,9 +1,9 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{ config
+, pkgs
+, lib
+, ...
+}:
+let
   keys = import ../../../variables/keys.nix;
   inherit
     (import ../../lib/default.nix {
@@ -16,7 +16,8 @@
   inherit (lib) types;
 
   cfg = config.users.commonUsers;
-in {
+in
+{
   options.users.commonUsers = {
     enable = lib.mkOption {
       default = true;
@@ -32,8 +33,14 @@ in {
       default = config.sops.secrets.sharedUsers-root.path;
       type = types.path;
     };
+
+    installPassword = lib.mkOption {
+      default = "";
+      type = types.str;
     };
-  config = lib.mkIf cfg.enable {
+  };
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.mkIf (cfg.installPassword == "") {
       sops.secrets.sharedUsers-root = {
         sopsFile = ../../../../secrets/shared-users.yaml;
         neededForUsers = true;
@@ -51,22 +58,39 @@ in {
         # neededForUsers = true;
         format = "yaml";
       };
+    })
 
+    {
       users.mutableUsers = lib.mkForce false;
 
-    users.extraUsers.root = {
-      passwordFile = cfg.rootPasswordFile;
+      users.users.root = lib.mkMerge [
+        {
           openssh.authorizedKeys.keys = keys.users.steveej.openssh;
+        }
 
-      # TODO: investigate why this secret cannot be found
-      # openssh.authorizedKeys.keyFiles = [
-      #   config.sops.secrets.sharedSshKeys-steveej.path
-      # ];
-    };
+        (lib.mkIf (cfg.installPassword != "") {
+          password = cfg.installPassword;
+        })
 
-    users.extraUsers.steveej = lib.mkIf cfg.enableNonRoot (mkUser {
+        (lib.mkIf (cfg.installPassword == "") {
+          hashedPasswordFile = cfg.rootPasswordFile;
+        })
+      ];
+
+
+      users.users.steveej = lib.mkIf cfg.enableNonRoot (mkUser (lib.mkMerge [
+        {
           uid = 1000;
-      passwordFile = config.sops.secrets.sharedUsers-steveej.path;
-    });
-  };
+        }
+
+        (lib.mkIf (cfg.installPassword != "") {
+          password = cfg.installPassword;
+        })
+
+        (lib.mkIf (cfg.installPassword == "") {
+          hashedPasswordFile = config.sops.secrets.sharedUsers-steveej.path;
+        })
+      ]));
+    }
+  ]);
 }

nix/os/snippets/sway-desktop.nix

@@ -35,6 +35,10 @@ in
     # $ xdg-open "https://github.com/"
     # Error: GDBus.Error:org.freedesktop.DBus.Error.UnknownMethod: No such interface “org.freedesktop.portal.OpenURI” on object at path /org/freedesktop/portal/desktop
     xdgOpenUsePortal = false;
+
+    # keep the behaviour in < 1.17, which uses the first portal implementation found in lexicographical order, use the following:
+    config.common.default = "*";
+
     extraPortals = [
       pkgs.xdg-desktop-portal-wlr
       pkgs.xdg-desktop-portal-gtk
@@ -59,8 +63,6 @@ in
     #jack.enable = true;
   };
 
-  networkmanager.enable = false;
-
   security.pam.services.getty.enableGnomeKeyring = true;
   services.gnome.gnome-keyring.enable = true;
   # autologin steveej on tty1

nix/os/snippets/timezone.nix

@@ -0,0 +1,9 @@
+{ lib, ... }:
+
+let
+  passwords = import ../../../variables/passwords.crypt.nix;
+
+in
+{
+  time.timeZone = lib.mkDefault passwords.timeZone.stefan;
+}