pub-solar/infra
6
1
Fork 3
Code Issues 24 Pull requests 10 Actions Packages Projects 1 Releases Wiki Activity

auth: add user for each administrator #261

Open
b12f wants to merge 4 commits from per-admin-user into main
pull from: per-admin-user
merge into: pub-solar:main
Conversation 4 Commits 4 Files changed 14 +39 -50
2 changed files with 39 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 5366d07d44 - Show all commits

15
logins/default.nix
View file

@ -6,18 +6,11 @@ in
{ {
flake = { flake = {
logins = { logins = {
admins = admins = admins;
lib.lists.foldl
(logins: adminConfig: {
sshPubKeys = logins.sshPubKeys ++ (lib.attrsets.attrValues adminConfig.sshPubKeys);
wireguardDevices = wireguardDevices =
logins.wireguardDevices lib.lists.foldl
++ (if adminConfig ? "wireguardDevices" then adminConfig.wireguardDevices else [ ]); (wireguardDevices: adminConfig: wireguardDevices ++ (if adminConfig ? "wireguardDevices" then adminConfig.wireguardDevices else [ ]))
}) [ ]
{
sshPubKeys = [ ];
wireguardDevices = [ ];
}
(lib.attrsets.attrValues admins); (lib.attrsets.attrValues admins);
robots.sshPubKeys = lib.attrsets.attrValues robots; robots.sshPubKeys = lib.attrsets.attrValues robots;
}; };

44
modules/core/users.nix
View file

@ -11,18 +11,6 @@
inherit (lib) mkOption types; inherit (lib) mkOption types;
in in
{ {
username = mkOption {
description = "Username for the adminstrative user";
type = types.str;
default = flake.self.username;
};
sshPubKeys = mkOption {
description = "SSH Keys that should have administrative root access";
type = types.listOf types.str;
default = flake.self.logins.admins.sshPubKeys;
};
root.initialHashedPassword = mkOption { root.initialHashedPassword = mkOption {
description = "Hashed password of the root account"; description = "Hashed password of the root account";
type = types.str; type = types.str;
@ -43,22 +31,26 @@
}; };
config = { config = {
users.users.${config.pub-solar-os.authentication.username} = { users.users = (lib.attrsets.foldlAttrs
name = config.pub-solar-os.authentication.username; (acc: name: value: acc // { ${name} = {
group = config.pub-solar-os.authentication.username; name = name;
group = name;
extraGroups = [ extraGroups = [
"wheel" "wheel"
"docker" "docker"
]; ];
isNormalUser = true; isNormalUser = true;
openssh.authorizedKeys.keys = config.pub-solar-os.authentication.sshPubKeys; openssh.authorizedKeys.keys = lib.attrsets.attrValues value.sshPubKeys;
}; };
users.groups.${config.pub-solar-os.authentication.username} = { }; })
{ }
flake.self.logins.admins)
// {
# TODO: Remove when we stop locking ourselves out. # TODO: Remove when we stop locking ourselves out.
users.users.root.openssh.authorizedKeys.keys = config.pub-solar-os.authentication.sshPubKeys; root.openssh.authorizedKeys.keys = config.pub-solar-os.authentication.sshPubKeys;
root.initialHashedPassword = config.pub-solar-os.authentication.root.initialHashedPassword;
users.users.${config.pub-solar-os.authentication.robot.username} = { ${config.pub-solar-os.authentication.robot.username} = {
description = "CI and automation user"; description = "CI and automation user";
home = "/home/${config.pub-solar-os.authentication.robot.username}"; home = "/home/${config.pub-solar-os.authentication.robot.username}";
createHome = true; createHome = true;
@ -68,11 +60,15 @@
isSystemUser = true; isSystemUser = true;
openssh.authorizedKeys.keys = config.pub-solar-os.authentication.robot.sshPubKeys; openssh.authorizedKeys.keys = config.pub-solar-os.authentication.robot.sshPubKeys;
}; };
};
users.groups.${config.pub-solar-os.authentication.robot.username} = { }; users.groups = (lib.attrsets.foldlAttrs
(acc: name: value: acc // { "${name}" = { }; })
users.users.root.initialHashedPassword = { }
config.pub-solar-os.authentication.root.initialHashedPassword; flake.self.logins.admins)
// {
${config.pub-solar-os.authentication.robot.username} = { };
};
security.sudo.wheelNeedsPassword = false; security.sudo.wheelNeedsPassword = false;
}; };