Rebase to flake parts #7

2026-05-08 19:12:16 -03:00
parent 1015cf4577
commit f98606dcce
23 changed files with 1060 additions and 11 deletions
@@ -0,0 +1,76 @@
+# Shared user definitions for all hosts that import `nixosModules.users`.
+# Module (not bare attrset) so catalog entries can use `config.*` for sops paths etc.
+{ ... }: {
+  flake.nixosModules.usersCatalogDefaults =
+    { config, ... }:
+    {
+      config.chiasson.users.catalog = {
+        olivier = {
+          isNormalUser = true;
+          description = "Olivier";
+          extraGroups = [
+            "networkmanager"
+            "wheel"
+            "libvirtd"
+            "docker"
+            "fuse"
+            "uinput"
+            "kvm"
+          ];
+
+          # Host must set `sops.secrets."users/olivier/hashedPassword".neededForUsers = true`.
+          # With that, `.path` is under /run/secrets-for-users/… (sops-nix README).
+          hashedPasswordFile = config.sops.secrets."users/olivier/hashedPassword".path;
+
+          homeManager = {
+            enable = true;
+            module =
+              { ... }:
+              {
+                home.username = "olivier";
+                home.homeDirectory = "/home/olivier";
+                home.stateVersion = "25.11";
+                programs.home-manager.enable = true;
+              };
+          };
+
+          ssh = {
+            inbound = {
+              enable = true;
+              authorizedHosts = "all";
+            };
+            outbound = {
+              rbw = {
+                enable = true;
+                hosts = "all";
+              };
+            };
+          };
+        };
+
+        server = {
+          isNormalUser = true;
+          description = "Server user";
+          extraGroups = [ "wheel" ];
+
+          homeManager = {
+            enable = false;
+            module = null;
+          };
+
+          ssh = {
+            inbound = {
+              enable = true;
+              authorizedHosts = "all";
+            };
+            outbound = {
+              rbw = {
+                enable = false;
+                hosts = "all";
+              };
+            };
+          };
+        };
+      };
+    };
+}