b12f/os
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

fix: passwordless sudo only for yule

Browse source
This commit is contained in:
Benjamin Bädorf 2023-10-26 14:09:11 +02:00
parent 9995e15760
commit 615ef9a856
No known key found for this signature in database
GPG key ID: 4406E80E13CD656C
3 changed files with 18 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
modules/core/default.nix
View file

@ -29,17 +29,6 @@ in {
# Limit the use of sudo to the group wheel # Limit the use of sudo to the group wheel
security.sudo.execWheelOnly = true; security.sudo.execWheelOnly = true;
security.sudo.extraRules = [
{
users = ["${psCfg.user.name}"];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
}
];
}
];
# Remove the complete default environment of packages like # Remove the complete default environment of packages like
# nano, perl and rsync # nano, perl and rsync

17
modules/user/default.nix
View file

@ -28,6 +28,11 @@ with lib; {
type = types.nullOr types.str; type = types.nullOr types.str;
default = null; default = null;
}; };
passwordlessSudo = mkOption {
description = "Whether this user can use sudo without entering a password";
type = types.bool;
default = false;
};
publicKeys = mkOption { publicKeys = mkOption {
description = "User SSH public keys"; description = "User SSH public keys";
type = types.listOf types.str; type = types.listOf types.str;
@ -81,5 +86,17 @@ with lib; {
else []; else [];
}; };
}; };
security.sudo.extraRules = mkIf psCfg.user.passwordlessSudo [
{
users = ["${psCfg.user.name}"];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
}
];
}
];
}; };
} }

1
users/yule/default.nix
View file

@ -15,6 +15,7 @@ in {
name = "yule"; name = "yule";
description = "b12f"; description = "b12f";
password = "$y$j9T$x1nyqcXw/1iYKo3054cdB1$0TOuyE5t5ZV6z9Gzl9zIrmZGADBxupnwcUMTcMtMa73"; password = "$y$j9T$x1nyqcXw/1iYKo3054cdB1$0TOuyE5t5ZV6z9Gzl9zIrmZGADBxupnwcUMTcMtMa73";
passwordlessSudo = true;
fullName = "Benjamin Bädorf"; fullName = "Benjamin Bädorf";
email = "hello@benjaminbaedorf.eu"; email = "hello@benjaminbaedorf.eu";
gpgKeyId = "4406E80E13CD656C"; gpgKeyId = "4406E80E13CD656C";