dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nixos/user: Load password from secret

Browse Source
This commit is contained in:
Jack O'Sullivan
2022-05-28 19:02:13 +01:00
parent c841b37f19
commit 4660406120
6 changed files with 82 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
nixos/boxes/colony/default.nix
View File

@@ -135,7 +135,6 @@
#deploy.generate.system.mode = "boot";
secrets = {
key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKp5WDdDr/1NS3SJIDOKwcCNZDFOxqPAD7cbZWAP7EkX";
files."test.txt" = {};
};
server.enable = true;

123
nixos/modules/user.nix
View File

@@ -1,7 +1,7 @@
{ lib, options, config, ... }:
let
inherit (lib) mkIf mkDefault mkOption mkAliasDefinitions;
inherit (lib.my) mkBoolOpt' mkDefault';
inherit (lib) mkIf mkDefault mkOption mkMerge mkAliasDefinitions;
inherit (lib.my) mkBoolOpt' mkOpt' mkDefault';
cfg = config.my.user;
user' = cfg.config;
@@ -10,6 +10,7 @@ in
{
options.my.user = with lib.types; {
enable = mkBoolOpt' true "Whether to create a primary user.";
passwordSecret = mkOpt' (nullOr str) "user-passwd.txt" "Name of user password secret.";
config = mkOption {
type = options.users.users.type.nestedTypes.elemType;
default = { };
@@ -24,65 +25,73 @@ in
};
};
config = mkIf cfg.enable {
my = {
user = {
config = {
name = mkDefault' "dev";
isNormalUser = true;
uid = mkDefault 1000;
extraGroups = mkDefault [ "wheel" "kvm" ];
password = mkDefault "hunter2"; # TODO: secrets...
shell =
let shell = cfg.homeConfig.my.shell;
in mkIf (shell != null) (mkDefault' shell);
openssh.authorizedKeys.keyFiles = [ lib.my.sshKeyFiles.me ];
};
homeConfig = {
# In order for this option to evaluate on its own, home-manager expects the `name` (which is derived from the
# parent attr name) to be the users name, aka `home-manager.users.<name>`
_module.args.name = lib.mkForce user'.name;
};
};
tmproot = {
unsaved.ignore = [
# Auto-generated (on activation?)
"/home/${user'.name}/.nix-profile"
"/home/${user'.name}/.nix-defexpr"
"/home/${user'.name}/.config/fish/fish_variables"
];
persistence.config =
let
perms = {
mode = "0700";
user = user.name;
group = user.group;
config = mkIf cfg.enable (mkMerge [
{
my = {
user = {
config = {
name = mkDefault' "dev";
isNormalUser = true;
uid = mkDefault 1000;
extraGroups = mkDefault [ "wheel" "kvm" ];
password = mkIf (cfg.passwordSecret == null) (mkDefault "hunter2");
shell =
let shell = cfg.homeConfig.my.shell;
in mkIf (shell != null) (mkDefault' shell);
openssh.authorizedKeys.keyFiles = [ lib.my.sshKeyFiles.me ];
};
in
{
files = map (file: {
inherit file;
parentDirectory = perms;
}) [
"/home/${user'.name}/.bash_history"
];
directories = map (directory: {
inherit directory;
} // perms) [
# Persist all of fish; it's not easy to persist just the history fish won't let you move it to a different
# directory. Also it does some funny stuff and can't really be a symlink it seems.
"/home/${user'.name}/.local/share/fish"
homeConfig = {
# In order for this option to evaluate on its own, home-manager expects the `name` (which is derived from the
# parent attr name) to be the users name, aka `home-manager.users.<name>`
_module.args.name = lib.mkForce user'.name;
};
};
tmproot = {
unsaved.ignore = [
# Auto-generated (on activation?)
"/home/${user'.name}/.nix-profile"
"/home/${user'.name}/.nix-defexpr"
"/home/${user'.name}/.config/fish/fish_variables"
];
persistence.config =
let
perms = {
mode = "0700";
user = user.name;
group = user.group;
};
in
{
files = map (file: {
inherit file;
parentDirectory = perms;
}) [
"/home/${user'.name}/.bash_history"
];
directories = map (directory: {
inherit directory;
} // perms) [
# Persist all of fish; it's not easy to persist just the history fish won't let you move it to a different
# directory. Also it does some funny stuff and can't really be a symlink it seems.
"/home/${user'.name}/.local/share/fish"
];
};
};
};
};
# mkAliasDefinitions will copy the unmerged defintions to allow the upstream submodule to deal with
users.users.${user'.name} = mkAliasDefinitions options.my.user.config;
# mkAliasDefinitions will copy the unmerged defintions to allow the upstream submodule to deal with
users.users.${user'.name} = mkAliasDefinitions options.my.user.config;
# NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
# passed to it
home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
};
# NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
# passed to it
home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
}
(mkIf (cfg.passwordSecret != null) {
my = {
secrets.files."${cfg.passwordSecret}" = {};
user.config.passwordFile = config.age.secrets."${cfg.passwordSecret}".path;
};
})
]);
}

1
nixos/vms/estuary/default.nix
View File

@@ -101,6 +101,7 @@
};
my = {
secrets.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhxM5mnguExkcLue47QKk1vA72OoPc3HOqqoHqHHfa1";
server.enable = true;
firewall = {