b12f
5366d07d44
After this has been tested successfully, root SSH login can be disabled. The advantages of having a user for each adminstrator: * Better security analysis: who issued executed what command, who touched which file, who used sudo at which time. * Possibility of granular access, e.g. person X is only allowed to manage service Y
19 lines
460 B
Nix
19 lines
460 B
Nix
{ lib, ... }:
|
|
let
|
|
admins = import ./admins.nix;
|
|
robots = import ./robots.nix;
|
|
in
|
|
{
|
|
flake = {
|
|
logins = {
|
|
admins = admins;
|
|
wireguardDevices =
|
|
lib.lists.foldl
|
|
(wireguardDevices: adminConfig: wireguardDevices ++ (if adminConfig ? "wireguardDevices" then adminConfig.wireguardDevices else [ ]))
|
|
[ ]
|
|
(lib.attrsets.attrValues admins);
|
|
robots.sshPubKeys = lib.attrsets.attrValues robots;
|
|
};
|
|
};
|
|
}
|