Gabe/nix-config
1
0
Fork 0
Code Issues 12 Pull requests Projects Releases Packages Wiki Activity

made nix-secrets input comment-out-able.

Browse source
This commit is contained in:
Gabe Venberg 2024-06-12 14:40:04 -05:00
parent f27b5ac056
commit 6147ddb903
10 changed files with 51 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

18
configs/nixos/common.nix
View file

@ -4,7 +4,10 @@
inputs,
lib,
...
}: {
}: let
# hash for "nixos"
defaultPasswordHash = "$y$j9T$u0O3PELyRv3GOemCReQhA0$Qb4Sl6dXnafYwZeDYrJGwS4xp3v6vGriWFMYomHH2w3";
in {
nix = {
package = pkgs.nixFlakes;
extraOptions = ''
@ -40,15 +43,22 @@
programs.zsh.enable = lib.mkDefault true;
environment.shells = lib.mkDefault [pkgs.zsh];
users.mutableUsers = false;
# if we arent setting our password from nix secrets, we need to allow changing it.
users.mutableUsers = !inputs ? nix-secrets;
users.users.${config.host.user} = {
isNormalUser = true;
hashedPassword = lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash");
hashedPassword =
if inputs ? nix-secrets
then (lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash"))
else defaultPasswordHash;
description = config.host.fullName;
shell = pkgs.zsh;
extraGroups = ["wheel"];
};
# users.users.root.password = lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash");
users.users.root.password =
if inputs ? nix-secrets
then (lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash"))
else defaultPasswordHash;
imports = [
../../modules/hostopts.nix

17
configs/nixos/secrets.nix
View file

@ -5,17 +5,20 @@
pkgs,
...
}: let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsDirectory = builtins.toString (inputs.nix-secrets or "");
in {
imports = [
inputs.sops-nix.nixosModules.sops
];
sops = {
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
config = lib.mkIf (inputs ? nix-secrets) {
sops = {
defaultSopsFile = "${secretsDirectory}/common.yaml";
validateSopsFiles = false;
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
};
};
}

7
configs/nixos/sshd.nix
View file

@ -16,8 +16,11 @@
kitty.terminfo
];
users.users.root.openssh.authorizedKeys.keys =
lib.mkDefault (configLib.dirToStrings "${inputs.nix-secrets}/public-keys");
users.users.root.openssh.authorizedKeys.keys = lib.mkDefault (
if inputs ? nix-secrets
then (configLib.dirToStrings "${inputs.nix-secrets}/public-keys")
else []
);
# if it can log into root, it should also be able to log in to the main user.
users.users.${config.host.user}.openssh.authorizedKeys.keys =
config.users.users.root.openssh.authorizedKeys.keys;