TheWanderingCrow/CrOS
1
0
Fork 0
mirror of https://github.com/TheWanderingCrow/CrOS.git synced 2026-01-11 09:44:08 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

working on figuring out how to use sops while inside of a vm

Browse source
This commit is contained in:
TheWanderingCrow 2025-06-24 16:07:29 -04:00
parent dbb0c97868
commit cf387f536a
1 changed files with 32 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

59
hosts/common/users/primary/nixos.nix
View file

@ -12,35 +12,40 @@
# Decrypt password to /run/secrets-for-users/ so it can be used to create the user
sopsHashedPasswordFile = lib.optionalString (!config.hostSpec.isMinimal) config.sops.secrets."passwords/${hostSpec.username}".path;
in {
users.mutableUsers = false; # Only allow declarative credentials; Required for password to be set via sops during system activation!
users.users.${hostSpec.username} = {
home = "/home/${hostSpec.username}";
isNormalUser = true;
hashedPasswordFile = sopsHashedPasswordFile; # Blank if sops is not working.
users = {
mutableUsers = false; # Only allow declarative credentials; Required for password to be set via sops during system activation!
users = {
# Default user for the host set in hostspec
${hostSpec.username} = {
home = "/home/${hostSpec.username}";
isNormalUser = true;
hashedPasswordFile = sopsHashedPasswordFile; # Blank if sops is not working.
extraGroups = lib.flatten [
"wheel"
(ifTheyExist [
"audio"
"video"
"docker"
"podman"
"dialout"
"git"
"networkmanager"
"scanner" # for print/scan"
"lp" # for print/scan"
])
];
extraGroups = lib.flatten [
"wheel"
(ifTheyExist [
"audio"
"video"
"docker"
"podman"
"dialout"
"git"
"networkmanager"
"scanner" # for print/scan"
"lp" # for print/scan"
])
];
};
# Root user setup
root = {
shell = pkgs.zsh;
hashedPasswordFile = config.users.users.${hostSpec.username}.hashedPasswordFile;
hashedPassword = config.users.users.${hostSpec.username}.hashedPassword;
openssh.authorizedKeys.keys = config.users.users.${hostSpec.username}.openssh.authorizedKeys.keys; # root's ssh keys are mainly used for remote deployment.
};
};
};
# No matter what environment we are in we want these tools for root, and the user(s)
programs.git.enable = true;
users.users.root = {
shell = pkgs.zsh;
hashedPasswordFile = config.users.users.${hostSpec.username}.hashedPasswordFile;
hashedPassword = config.users.users.${hostSpec.username}.hashedPassword; # This comes from hosts/common/optional/minimal.nix and gets overridden if sops is working
openssh.authorizedKeys.keys = config.users.users.${hostSpec.username}.openssh.authorizedKeys.keys; # root's ssh keys are mainly used for remote deployment.
};
}