80 lines
2.2 KiB
Nix
80 lines
2.2 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.naxos.users;
|
|
in {
|
|
options.services.naxos.users = {
|
|
enable = mkEnableOption "NaxOS Declarative User Management";
|
|
|
|
adminUser = mkOption {
|
|
type = types.str;
|
|
default = "admin";
|
|
description = "Primary administrator account name.";
|
|
};
|
|
|
|
adminSshKeys = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = "Public SSH keys for the administrator.";
|
|
};
|
|
|
|
users = mkOption {
|
|
type = types.attrsOf (types.submodule {
|
|
options = {
|
|
description = mkOption {
|
|
type = types.str;
|
|
default = "";
|
|
description = "User full name or comment.";
|
|
};
|
|
isAdmin = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Whether the user has sudo/wheel privileges.";
|
|
};
|
|
sshKeys = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = "Public SSH authorized keys.";
|
|
};
|
|
extraGroups = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = "Additional Linux groups.";
|
|
};
|
|
smbAccess = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description = "Whether the user can access SMB shares.";
|
|
};
|
|
};
|
|
});
|
|
default = {};
|
|
description = "Appliance user accounts.";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
users.mutableUsers = true;
|
|
|
|
# Admin and additional user creation
|
|
users.users = {
|
|
${cfg.adminUser} = {
|
|
isNormalUser = true;
|
|
description = "NaxOS Primary Administrator";
|
|
extraGroups = [ "wheel" "docker" "video" "render" "users" ];
|
|
openssh.authorizedKeys.keys = cfg.adminSshKeys;
|
|
shell = pkgs.bashInteractive;
|
|
};
|
|
} // (mapAttrs (name: ucfg: {
|
|
isNormalUser = true;
|
|
description = ucfg.description;
|
|
extraGroups = (if ucfg.isAdmin then [ "wheel" ] else []) ++ ucfg.extraGroups ++ [ "users" ];
|
|
openssh.authorizedKeys.keys = ucfg.sshKeys;
|
|
}) cfg.users);
|
|
|
|
security.sudo.wheelNeedsPassword = false;
|
|
};
|
|
}
|