refactor(flake): add user registry and multi-user host support
Separate user identity (data) from the reusable modules, and let a host declare any number of users instead of exactly one. - users/registry.nix: per-user identity (name, email, groups, authorized and signing keys) as the single source of identity; no user data is hardcoded in the modules. - mkHost takes a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg (extraSpecialArgs is per-host, so it cannot carry per-user data). - modules/users.nix builds accounts from the registry; modules/ssh.nix no longer defines authorized keys (the registry owns them); home/git.nix and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops its now-redundant git identity override. - Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the former lyrathorpe/ and system/ layout. - Add standalone homeConfigurations (the portable subset: shell, git, editor, claude) and an exported homeModules output for use on machines not managed by this flake, or as an input to other flakes. Behaviour-preserving for existing hosts: lyrathorpe-mbp and emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400, lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a repeated authorized_keys entry. Fixes the SSH authorized-key leak (one user's key was applied to every account), the hardcoded default git identity, and the hardcoded EDaaS linger setting.
This commit is contained in:
Emma Thorpe
@@ -0,0 +1,62 @@
|
||||
# Options shared by every NixOS host (laptops and the WSL box). Imported via
|
||||
# baseModules in flake.nix. Host- and platform-specific settings stay in the
|
||||
# per-machine configs; laptop-only settings live in ./laptop.nix.
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
time.timeZone = "Europe/London";
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
# Store hygiene. auto-optimise-store hard-links identical files in the store
|
||||
# after each build (cheap dedupe; NOT a garbage collector -- there is
|
||||
# deliberately no automatic GC timer). The larger download buffer avoids
|
||||
# "buffer full" stalls when fetching big NARs over a fast link.
|
||||
nix.settings.auto-optimise-store = true;
|
||||
nix.settings.download-buffer-size = 134217728; # 128 MiB
|
||||
|
||||
# Extra binary cache for the nix-community toolchain (home-manager, nixvim,
|
||||
# treefmt, ...). Merges with any host-specific caches (e.g. the Asahi cache on
|
||||
# the MBP) rather than replacing them.
|
||||
nix.settings.substituters = [ "https://nix-community.cachix.org" ];
|
||||
nix.settings.trusted-public-keys = [
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
|
||||
# Run dynamically-linked foreign binaries (VS Code remote server, prebuilt
|
||||
# toolchains, language-server downloads) on every NixOS host, not just WSL.
|
||||
programs.nix-ld.enable = true;
|
||||
|
||||
# Minimal system-level CLI available before the home-manager profile loads
|
||||
# (e.g. early boot / rescue). User-level tooling lives in home-manager.
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
fastfetch
|
||||
];
|
||||
|
||||
# Fonts on every host. The Nerd Font carries the powerline/Nerd glyphs the
|
||||
# tmux statusline uses (foot names it explicitly in home/sway.nix); Noto sans +
|
||||
# colour emoji prevent tofu in terminals/TUIs/Firefox -- important on the WSL
|
||||
# box, which does not pull the graphical hosts' default Noto stack. The Mac
|
||||
# installs the Nerd Font via the Darwin config.
|
||||
fonts.packages = with pkgs; [
|
||||
nerd-fonts.jetbrains-mono
|
||||
noto-fonts
|
||||
noto-fonts-color-emoji
|
||||
];
|
||||
# Map the generic fontconfig families so anything asking for "monospace" gets
|
||||
# the Nerd Font (with emoji fallback), not DejaVu.
|
||||
fonts.fontconfig.defaultFonts = {
|
||||
monospace = [
|
||||
"JetBrainsMono Nerd Font"
|
||||
"Noto Color Emoji"
|
||||
];
|
||||
sansSerif = [
|
||||
"Noto Sans"
|
||||
"Noto Color Emoji"
|
||||
];
|
||||
serif = [
|
||||
"Noto Serif"
|
||||
"Noto Color Emoji"
|
||||
];
|
||||
emoji = [ "Noto Color Emoji" ];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
# Desktop (non-portable) NixOS hosts. Counterpart to ./laptop.nix: imports the
|
||||
# shared ./workstation.nix base and swaps the mobile Wi-Fi backend for wired
|
||||
# NetworkManager. A desktop host also sets `portable = false` in its host-table
|
||||
# entry (flake.nix), which drops the battery block and brightness keybindings
|
||||
# from the Sway bar -- see home/sway.nix.
|
||||
{ ... }:
|
||||
{
|
||||
imports = [ ./workstation.nix ];
|
||||
|
||||
# Wired networking. NetworkManager handles DHCP/connections itself; do not
|
||||
# combine with networking.wireless.* (laptop.nix) -- the two backends conflict.
|
||||
networking.networkmanager.enable = true;
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
# Feature-flag option declarations shared by every NixOS host (imported via
|
||||
# baseModules in flake.nix). Declaring the flags here -- rather than inside the
|
||||
# module that implements them -- means a host can read or set a flag without
|
||||
# importing the (often large) implementation module. In particular,
|
||||
# features.swayDesktop.enable is read by modules/users.nix on every host, but a
|
||||
# headless host (e.g. the Pi) must be able to leave it at its default without
|
||||
# pulling in modules/sway.nix. The implementation lives in modules/sway.nix,
|
||||
# gated on this flag.
|
||||
{ lib, ... }:
|
||||
{
|
||||
options.features.swayDesktop.enable = lib.mkEnableOption "the Sway desktop";
|
||||
}
|
||||
Executable
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
@@ -0,0 +1,31 @@
|
||||
# Portable NixOS hosts (X1, MBP-Asahi). Imported from the host table in
|
||||
# flake.nix. Shared graphical-workstation settings live in ./workstation.nix;
|
||||
# the only laptop-specific bit is the Wi-Fi backend. Mobile home-manager
|
||||
# components (battery block, brightness keys) are gated by the `portable` flag
|
||||
# threaded through mkHost -- see home/sway.nix.
|
||||
{ ... }:
|
||||
{
|
||||
imports = [ ./workstation.nix ];
|
||||
|
||||
# Wi-Fi via iwd with its built-in DHCP/network configuration.
|
||||
networking.wireless.iwd = {
|
||||
enable = true;
|
||||
settings.General.EnableNetworkConfiguration = true;
|
||||
};
|
||||
|
||||
# Lid behaviour: suspend on battery, lock on external power (swayidle's
|
||||
# before-sleep hook locks before the suspend completes either way).
|
||||
services.logind.settings.Login = {
|
||||
HandleLidSwitch = "suspend";
|
||||
HandleLidSwitchExternalPower = "lock";
|
||||
};
|
||||
|
||||
# Bluetooth. The Asahi MBP loads Apple's BT firmware (see its host config) and
|
||||
# the T400 has an optional BT module; enable bluez on both, with blueman as the
|
||||
# GUI/tray manager for the Sway session.
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
powerOnBoot = true;
|
||||
};
|
||||
services.blueman.enable = true;
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
|
||||
# RPi5). The host config still does `services.openssh.enable = true` and opens
|
||||
# port 22 next to where it documents the listening service; this module only
|
||||
# tightens the policy so a host opting into sshd cannot accidentally ship
|
||||
# password/root login. Authorized keys are owned per-user by the identity
|
||||
# registry (users/registry.nix, applied via modules/users.nix), not here.
|
||||
{ ... }:
|
||||
{
|
||||
services.openssh.settings = {
|
||||
PasswordAuthentication = false; # keys only
|
||||
KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,161 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.features.swayDesktop;
|
||||
# Catppuccin Mocha (shared with the Sway desktop, see home/sway.nix).
|
||||
ctp = import ../lib/catppuccin-mocha.nix;
|
||||
in
|
||||
{
|
||||
# The features.swayDesktop.enable option is declared in
|
||||
# system/modules/features.nix (so headless hosts can read/set it without
|
||||
# importing this module). This module only provides its implementation.
|
||||
config = lib.mkIf cfg.enable {
|
||||
programs.sway = {
|
||||
enable = true;
|
||||
wrapperFeatures.gtk = true;
|
||||
extraSessionCommands = ''
|
||||
# QT
|
||||
export QT_QPA_PLATFORM="wayland;xcb"
|
||||
export QT_QPA_PLATFORMTHEME=qt5ct
|
||||
# SDL
|
||||
export SDL_VIDEODRIVER=wayland
|
||||
# Java
|
||||
export _JAVA_AWT_WM_NONREPARENTING=1
|
||||
# Misc
|
||||
export CLUTTER_BACKEND=wayland
|
||||
export WINIT_UNIX_BACKEND=wayland
|
||||
export MOZ_ENABLE_WAYLAND=1
|
||||
'';
|
||||
# Core Wayland utilities. The lock screen, idle daemon, status bar and
|
||||
# notification daemon are configured per-user in home/sway.nix.
|
||||
extraPackages = with pkgs; [
|
||||
brightnessctl
|
||||
foot
|
||||
grim
|
||||
slurp # region selection for screenshots
|
||||
swappy # screenshot annotation/save
|
||||
jq # used by the focused-window screenshot bind
|
||||
playerctl # MPRIS media keys
|
||||
sway-launcher-desktop
|
||||
pavucontrol
|
||||
];
|
||||
};
|
||||
fonts.packages = with pkgs; [
|
||||
noto-fonts
|
||||
noto-fonts-color-emoji
|
||||
font-awesome
|
||||
];
|
||||
|
||||
# Wayland login screen (replaces console/getty login on every Sway host).
|
||||
# greetd runs ReGreet inside the cage kiosk compositor; the Sway session is
|
||||
# offered automatically because programs.sway registers itself via
|
||||
# services.displayManager.sessionPackages. Hosts that turn off
|
||||
# features.swayDesktop (e.g. EDaaS) keep plain TTY login.
|
||||
programs.regreet.enable = true;
|
||||
# Theme the greeter to match the Sway desktop (Catppuccin Mocha). ReGreet is
|
||||
# GTK; recolour via CSS (covering both libadwaita named colours and plain
|
||||
# GTK node selectors) and use the same Noto Sans as the bar/notifications.
|
||||
programs.regreet.font = {
|
||||
name = "Noto Sans";
|
||||
package = pkgs.noto-fonts;
|
||||
size = 16;
|
||||
};
|
||||
programs.regreet.extraCss = ''
|
||||
/* GTK4 Adwaita legacy names (what plain GTK4 actually references). */
|
||||
@define-color theme_bg_color #${ctp.base};
|
||||
@define-color theme_fg_color #${ctp.text};
|
||||
@define-color theme_base_color #${ctp.mantle};
|
||||
@define-color theme_text_color #${ctp.text};
|
||||
@define-color theme_selected_bg_color #${ctp.blue};
|
||||
@define-color theme_selected_fg_color #${ctp.base};
|
||||
@define-color insensitive_bg_color #${ctp.mantle};
|
||||
@define-color insensitive_fg_color #${ctp.overlay0};
|
||||
@define-color borders #${ctp.surface1};
|
||||
@define-color warning_color #${ctp.peach};
|
||||
@define-color error_color #${ctp.red};
|
||||
@define-color success_color #${ctp.green};
|
||||
|
||||
/* libadwaita names (inert on plain GTK4, kept for forward-compat). */
|
||||
@define-color window_bg_color #${ctp.base};
|
||||
@define-color window_fg_color #${ctp.text};
|
||||
@define-color view_bg_color #${ctp.mantle};
|
||||
@define-color view_fg_color #${ctp.text};
|
||||
@define-color card_bg_color #${ctp.surface0};
|
||||
@define-color card_fg_color #${ctp.text};
|
||||
@define-color accent_bg_color #${ctp.blue};
|
||||
@define-color accent_fg_color #${ctp.base};
|
||||
@define-color accent_color #${ctp.blue};
|
||||
@define-color destructive_bg_color #${ctp.red};
|
||||
@define-color destructive_fg_color #${ctp.base};
|
||||
|
||||
window {
|
||||
background-color: #${ctp.base};
|
||||
color: #${ctp.text};
|
||||
}
|
||||
|
||||
label {
|
||||
color: #${ctp.text};
|
||||
}
|
||||
|
||||
entry {
|
||||
background-color: #${ctp.surface0};
|
||||
color: #${ctp.text};
|
||||
border: 1px solid #${ctp.surface1};
|
||||
}
|
||||
|
||||
entry:focus-within {
|
||||
border-color: #${ctp.blue};
|
||||
}
|
||||
|
||||
button,
|
||||
combobox button {
|
||||
background-color: #${ctp.surface0};
|
||||
color: #${ctp.text};
|
||||
border: 1px solid #${ctp.surface1};
|
||||
}
|
||||
|
||||
button:hover {
|
||||
background-color: #${ctp.surface1};
|
||||
}
|
||||
|
||||
button:active,
|
||||
button:checked {
|
||||
background-color: #${ctp.blue};
|
||||
color: #${ctp.base};
|
||||
}
|
||||
'';
|
||||
# cage reads the XKB_* environment at startup, so force the greeter onto the
|
||||
# same Dvorak layout as the Sway session (home/sway.nix) -- otherwise the
|
||||
# password field would be QWERTY. Dvorak is the "us" layout's variant, NOT a
|
||||
# layout of its own: "dvorak" alone has no symbols/ file, so the keymap
|
||||
# fails to compile and the greeter ends up with no keyboard at all (the
|
||||
# greeter has no fallback, unlike a running Sway session). This overrides the
|
||||
# greetd command regreet sets with mkDefault.
|
||||
services.greetd.settings.default_session.command =
|
||||
let
|
||||
greeter = pkgs.writeShellScript "regreet-cage" ''
|
||||
export XKB_DEFAULT_LAYOUT=us
|
||||
export XKB_DEFAULT_VARIANT=dvorak
|
||||
# ReGreet is plain GTK4 (no libadwaita); force the dark Adwaita variant
|
||||
# so the extraCss accents sit on a dark base instead of light Adwaita.
|
||||
export GTK_THEME=Adwaita:dark
|
||||
exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} -s -- ${lib.getExe config.programs.regreet.package}
|
||||
'';
|
||||
in
|
||||
"${greeter}";
|
||||
|
||||
# Desktop portals: enables screen sharing (wlroots) and native file pickers
|
||||
# for Wayland apps such as Element and Firefox.
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
wlr.enable = true;
|
||||
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
config.common.default = "*";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
# System-level user accounts, built from the identity registry
|
||||
# (users/registry.nix). `hostUsers` is the host's user set, threaded by mkHost
|
||||
# from the flake host table; `userRegistry` is the global identity table passed
|
||||
# as a specialArg. Every account's identity -- description, groups, authorized
|
||||
# keys -- comes from its registry entry, so no user data is hardcoded here and a
|
||||
# host may declare any number of users.
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
hostUsers,
|
||||
userRegistry,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
programs.zsh.enable = true;
|
||||
|
||||
users.users = lib.mapAttrs (
|
||||
name: spec:
|
||||
let
|
||||
id = userRegistry.${name};
|
||||
in
|
||||
{
|
||||
isNormalUser = true;
|
||||
home = "/home/${name}";
|
||||
description = id.fullName;
|
||||
inherit (id) extraGroups;
|
||||
openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
|
||||
shell = pkgs.zsh;
|
||||
}
|
||||
# Keep this user's systemd --user instance running without an open login
|
||||
# session (e.g. for home-manager user timers). Only emitted when the host
|
||||
# table opts in, so hosts that don't set it leave linger entirely unmanaged.
|
||||
// lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
|
||||
) hostUsers;
|
||||
|
||||
programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
|
||||
enable = true;
|
||||
};
|
||||
programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
|
||||
enable = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
# Form-factor-agnostic base for the physical graphical NixOS machines. Imported
|
||||
# by both ./laptop.nix and ./desktop.nix; those add only the bits that differ
|
||||
# between portable and desktop hosts (chiefly the networking backend).
|
||||
#
|
||||
# The bootloader is NOT set here -- it is firmware-specific, not form-factor:
|
||||
# UEFI hosts (MBP, Mac Pro 3,1) use systemd-boot, the BIOS-only T400 uses GRUB.
|
||||
# Each machine config declares its own.
|
||||
{ lib, pkgs, ... }:
|
||||
{
|
||||
features.swayDesktop.enable = true;
|
||||
|
||||
console.keyMap = "dvorak";
|
||||
|
||||
# Intel thermal management. x86 only -- the Asahi MBP governs its own SoC
|
||||
# thermals, and thermald is an Intel-platform daemon.
|
||||
services.thermald.enable = lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 true;
|
||||
|
||||
# Default-deny inbound. Hosts that run a listening service open their own
|
||||
# ports next to where the service is enabled (e.g. sshd -> 22 on X1).
|
||||
networking.firewall.enable = true;
|
||||
|
||||
# Disk hygiene for the physical hosts. fstrim reclaims unused SSD blocks on a
|
||||
# weekly timer; cleanOnBoot wipes /tmp at every boot.
|
||||
services.fstrim.enable = true;
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
|
||||
# Userspace OOM killer: act on memory pressure early instead of letting the
|
||||
# kernel OOM-thrash. Matters on the 4 GiB T400 and the elderly Mac Pro.
|
||||
services.earlyoom.enable = true;
|
||||
|
||||
# Firmware updates via LVFS. No-op on the Asahi MBP (Apple-managed firmware),
|
||||
# useful for UEFI/SSD updates on the x86 hosts.
|
||||
services.fwupd.enable = true;
|
||||
|
||||
# Audio. PipeWire with the PulseAudio shim covers every graphical host; no
|
||||
# per-machine audio config is needed.
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
|
||||
# swaylock PAM stack. None of these machines has working fingerprint auth, so
|
||||
# an empty service is enough -- swaylock falls back to password.
|
||||
security.pam.services.swaylock = { };
|
||||
|
||||
# Redistributable firmware (GPU/Wi-Fi/NIC blobs) for the x86 hosts. Harmless
|
||||
# on the Asahi MBP, which supplies its own peripheral firmware out-of-band.
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
}
|
||||
Reference in New Issue
Block a user