hosts/legion: init

Signed-off-by: unexplrd <unexplrd@linerds.us>

hosts/legion/users.nix

@@ -0,0 +1,25 @@
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}: let
+  inherit (config.sops) secrets;
+  inherit (inputs) mysecrets;
+in {
+  nix.settings.trusted-users = ["user" "nix-ssh"];
+  users.mutableUsers = false;
+  users.users = {
+    user = {
+      hashedPasswordFile = secrets."user-password-hashed".path;
+      extraGroups = ["wheel" "video" "libvirtd" "dialout"];
+      isNormalUser = true;
+      shell = pkgs.fish;
+      openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
+        "id_dunamis_ed25519.pub"
+        "id_eldrid_ed25519.pub"
+        "id_sarien_ed25519.pub"
+      ];
+    };
+  };
+}