unexplrd/nixos-blueprint
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flake.lock: update secrets

Browse Source 
hosts/dunamis/users.nix: update secrets
hosts/sarien/users.nix: update secrets

Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
unexplrd
2025-04-06 13:24:23 +03:00
parent 150c8676d2
commit d5521a468d
3 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
flake.lock generated
View File

@ -1120,11 +1120,11 @@
"mysecrets": {
"flake": false,
"locked": {
"lastModified": 1743273192,
"narHash": "sha256-G9VhIc+Fc+w4LDR81xmkj3xxbrvYJUOTM9sM4191ucY=",
"lastModified": 1743935322,
"narHash": "sha256-x/yc+PK6q8mE1iWh43GRBfN0CfLL2RH4fDHvmQwcVRo=",
"ref": "refs/heads/main",
"rev": "e8f749354223905785f4510fde10b528bf1b2ba2",
"revCount": 13,
"rev": "44bde2e703b87c91862d9273c57f8122a6b408b3",
"revCount": 14,
"type": "git",
"url": "ssh://gitea@gitea.linerds.us/unexplrd/nix-secrets"
},

13
hosts/dunamis/users.nix
View File

@ -4,20 +4,21 @@
pkgs,
...
}: let
sopSec = config.sops.secrets;
s = inputs.mysecrets;
inherit (config.sops) secrets;
inherit (inputs) mysecrets;
in {
nix.settings.trusted-users = ["user" "nix-ssh"];
users.mutableUsers = false;
users.users = {
user = {
hashedPasswordFile = sopSec."user-password-hashed".path;
hashedPasswordFile = secrets."user-password-hashed".path;
extraGroups = ["wheel" "video" "libvirtd" "dialout"];
isNormalUser = true;
shell = pkgs.fish;
openssh.authorizedKeys.keyFiles = map (f: s + "/ssh/" + f) [
"id_ed25519_sarien_user.pub"
"id_ed25519_eldrid_user.pub"
openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
"id_dunamis_ed25519.pub"
"id_eldrid_ed25519.pub"
"id_sarien_ed25519.pub"
];
};
};

13
hosts/sarien/users.nix
View File

@ -4,20 +4,21 @@
pkgs,
...
}: let
sopSec = config.sops.secrets;
secrets = inputs.mysecrets;
inherit (config.sops) secrets;
inherit (inputs) mysecrets;
in {
nix.settings.trusted-users = ["user"];
users.mutableUsers = false;
users.users = {
user = {
hashedPasswordFile = sopSec."user-password-hashed".path;
hashedPasswordFile = secrets."user-password-hashed".path;
isNormalUser = true;
extraGroups = ["wheel" "video" "libvirtd" "dialout"];
shell = pkgs.fish;
openssh.authorizedKeys.keyFiles = [
"${secrets}/ssh/id_ed25519_sarien_user.pub"
"${secrets}/ssh/id_ed25519_eldrid_user.pub"
openssh.authorizedKeys.keyFiles = map (f: "${mysecrets}/ssh/user/${f}") [
"id_dunamis_ed25519.pub"
"id_eldrid_ed25519.pub"
"id_sarien_ed25519.pub"
];
};
};