kalipso/infrastructure
1
1
Fork 1
Code Issues 42 Pull Requests 2 Actions Projects 2 Releases Wiki Activity

User management module #80

Merged
kalipso merged 8 commits from issue77 into master 2025-03-04 17:22:24 +01:00
Conversation 7 Commits 8 Files Changed 4 +7 -5
3 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit eb61088dc9 - Show all commits

5
machines/bakunin/configuration.nix
View File

@@ -8,12 +8,11 @@ in
[ # Include the results of the hardware scan. [ # Include the results of the hardware scan.
#./hardware-configuration.nix #./hardware-configuration.nix
../modules/xserver.nix ../modules/xserver.nix
../modules/malobeo_user.nix
../modules/sshd.nix ../modules/sshd.nix
../modules/minimal_tools.nix
../modules/autoupdate.nix ../modules/autoupdate.nix
inputs.self.nixosModules.malobeo.disko inputs.self.nixosModules.malobeo.disko
inputs.self.nixosModules.malobeo.initssh inputs.self.nixosModules.malobeo.initssh
inputs.self.nixosModules.malobeo.users
]; ];
malobeo.autoUpdate = { malobeo.autoUpdate = {
@@ -38,6 +37,8 @@ in
ethernetDrivers = ["r8169"]; ethernetDrivers = ["r8169"];
}; };
malobeo.users.malobeo = true;
ahtlon commented 2025-03-01 21:44:07 +01:00
Review
Copy Link

With default enable, this does nothing anymore... Should we disable the admin account on bakunin? The autoupdate script should still run to apply updates but we (and any attackers) could no longer change the system manually

With default enable, this does nothing anymore... Should we disable the admin account on bakunin? The autoupdate script should still run to apply updates but we (and any attackers) could no longer change the system manually
hardware.sane.enable = true; #scanner support hardware.sane.enable = true; #scanner support
nix.settings.experimental-features = [ "nix-command" "flakes" ]; nix.settings.experimental-features = [ "nix-command" "flakes" ];

6
machines/modules/malobeo/users.nix
View File

@@ -1,7 +1,7 @@
{config, lib, pkgs, ...}: {config, lib, pkgs, inputs, ...}:
let let
cfg = config.malobeo.users; cfg = config.malobeo.users;
sshKeys = import ../ssh_keys.nix; sshKeys = import ( inputs.self + /machines/ssh_keys.nix);
in in
{ {
options.malobeo.users = { options.malobeo.users = {
@@ -21,7 +21,7 @@ in
environment.systemPackages = with pkgs; []; environment.systemPackages = with pkgs; [];
}) })
(lib.mkIf cfg.admin { (lib.mkIf cfg.admin {
users.user.admin = { users.users.admin = {
isNormalUser = true; isNormalUser = true;
description = "admin user, passwordless sudo access, only ssh"; description = "admin user, passwordless sudo access, only ssh";
ahtlon commented 2025-03-01 21:47:11 +01:00
Review
Copy Link

Should be changed at some point to use sops

Should be changed at some point to use sops
hashedPassword = null; hashedPassword = null;

1
outputs.nix
View File

@@ -113,6 +113,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
initssh.imports = [ ./machines/modules/malobeo/initssh.nix ]; initssh.imports = [ ./machines/modules/malobeo/initssh.nix ];
metrics.imports = [ ./machines/modules/malobeo/metrics.nix ]; metrics.imports = [ ./machines/modules/malobeo/metrics.nix ];
disko.imports = [ ./machines/modules/disko ]; disko.imports = [ ./machines/modules/disko ];
users.imports = [ ./machines/modules/malobeo/users.nix ];
}; };
hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) ( hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (