steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

feat(common/users): init module and add customization options

Browse source
This commit is contained in:
steveej 2023-08-11 18:50:10 +02:00
parent eaadacd8c7
commit 742e432ce7
1 changed files with 49 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

75
nix/os/profiles/common/user.nix
View file

@ -1,6 +1,7 @@
{ {
config, config,
pkgs, pkgs,
lib,
... ...
}: let }: let
keys = import ../../../variables/keys.nix; keys = import ../../../variables/keys.nix;
@ -11,39 +12,61 @@
}) })
mkUser mkUser
; ;
inherit (lib) types;
cfg = config.users.commonUsers;
in { in {
sops.secrets.sharedUsers-root = { options.users.commonUsers = {
sopsFile = ../../../../secrets/shared-users.yaml; enable = lib.mkOption {
neededForUsers = true; default = true;
format = "yaml"; type = types.bool;
};
enableNonRoot = lib.mkOption {
default = true;
type = types.bool;
};
rootPasswordFile = lib.mkOption {
default = config.sops.secrets.sharedUsers-root.path;
type = types.path;
};
}; };
config = lib.mkIf cfg.enable {
sops.secrets.sharedUsers-root = {
sopsFile = ../../../../secrets/shared-users.yaml;
neededForUsers = true;
format = "yaml";
};
sops.secrets.sharedUsers-steveej = { sops.secrets.sharedUsers-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml; sopsFile = ../../../../secrets/shared-users.yaml;
neededForUsers = true; neededForUsers = true;
format = "yaml"; format = "yaml";
}; };
sops.secrets.sharedSshKeys-steveej = { sops.secrets.sharedSshKeys-steveej = lib.mkIf cfg.enableNonRoot {
sopsFile = ../../../../secrets/shared-users.yaml; sopsFile = ../../../../secrets/shared-users.yaml;
# neededForUsers = true; # neededForUsers = true;
format = "yaml"; format = "yaml";
}; };
users.mutableUsers = false; users.mutableUsers = lib.mkForce false;
users.extraUsers.root = { users.extraUsers.root = {
passwordFile = config.sops.secrets.sharedUsers-root.path; passwordFile = cfg.rootPasswordFile;
openssh.authorizedKeys.keys = keys.users.steveej.openssh; openssh.authorizedKeys.keys = keys.users.steveej.openssh;
# TODO: investigate why this secret cannot be found # TODO: investigate why this secret cannot be found
# openssh.authorizedKeys.keyFiles = [ # openssh.authorizedKeys.keyFiles = [
# config.sops.secrets.sharedSshKeys-steveej.path # config.sops.secrets.sharedSshKeys-steveej.path
# ]; # ];
}; };
users.extraUsers.steveej = mkUser { users.extraUsers.steveej = lib.mkIf cfg.enableNonRoot (mkUser {
uid = 1000; uid = 1000;
passwordFile = config.sops.secrets.sharedUsers-steveej.path; passwordFile = config.sops.secrets.sharedUsers-steveej.path;
});
}; };
} }