Emma Thorpe
10cc6cceed
Separate user identity (data) from the reusable modules, and let a host declare any number of users instead of exactly one. - users/registry.nix: per-user identity (name, email, groups, authorized and signing keys) as the single source of identity; no user data is hardcoded in the modules. - mkHost takes a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg (extraSpecialArgs is per-host, so it cannot carry per-user data). - modules/users.nix builds accounts from the registry; modules/ssh.nix no longer defines authorized keys (the registry owns them); home/git.nix and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops its now-redundant git identity override. - Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the former lyrathorpe/ and system/ layout. - Add standalone homeConfigurations (the portable subset: shell, git, editor, claude) and an exported homeModules output for use on machines not managed by this flake, or as an input to other flakes. Behaviour-preserving for existing hosts: lyrathorpe-mbp and emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400, lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a repeated authorized_keys entry. Fixes the SSH authorized-key leak (one user's key was applied to every account), the hardcoded default git identity, and the hardcoded EDaaS linger setting.
79 lines
3.1 KiB
Nix
79 lines
3.1 KiB
Nix
# Edit this configuration file to define what should be installed on
|
|
# your system. Help is available in the configuration.nix(5) man page, on
|
|
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
|
|
|
# NixOS-WSL specific options are documented on the NixOS-WSL repository:
|
|
# https://github.com/nix-community/NixOS-WSL
|
|
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
{
|
|
|
|
wsl = {
|
|
enable = true;
|
|
defaultUser = "emmathorpe";
|
|
wslConf.automount.root = "/mnt";
|
|
wslConf.interop.appendWindowsPath = true;
|
|
wslConf.interop.enabled = true;
|
|
wslConf.network.generateHosts = false;
|
|
startMenuLaunchers = true;
|
|
docker-desktop.enable = false;
|
|
extraBin = with pkgs; [
|
|
# Binaries for Docker Desktop wsl-distro-proxy
|
|
{ src = "${coreutils}/bin/mkdir"; }
|
|
{ src = "${coreutils}/bin/cat"; }
|
|
{ src = "${coreutils}/bin/whoami"; }
|
|
{ src = "${coreutils}/bin/ls"; }
|
|
{ src = "${busybox}/bin/addgroup"; }
|
|
{ src = "${su}/bin/groupadd"; }
|
|
{ src = "${su}/bin/usermod"; }
|
|
];
|
|
};
|
|
|
|
virtualisation.docker = {
|
|
enable = true;
|
|
enableOnBoot = true;
|
|
autoPrune.enable = true;
|
|
};
|
|
|
|
# Match the flake's nixosConfigurations attribute name so `nh os switch`
|
|
# (which selects by the local hostname) resolves without an explicit
|
|
# -H/--hostname flag. The default would otherwise be the stock NixOS "nixos".
|
|
networking.hostName = "emmathorpe-edaas";
|
|
|
|
networking.resolvconf.enable = false;
|
|
|
|
# Drop the systemd-ssh-proxy Include from the generated /etc/ssh/ssh_config.
|
|
# The NixOS-WSL store is a read-only VHD whose files are owned by nobody
|
|
# (65534), not root. OpenSSH permission-checks Include'd config files and
|
|
# rejects any not owned by root or the caller, so the default include fails
|
|
# with "Bad owner or permissions" and breaks ssh/git for every command. The
|
|
# proxy plugin only matters for `ssh unix/…` / `vsock` to local machined VMs,
|
|
# which WSL does not use.
|
|
programs.ssh.systemd-ssh-proxy.enable = false;
|
|
|
|
## patch the script
|
|
systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"'';
|
|
|
|
features.swayDesktop.enable = false;
|
|
|
|
# NOTE: this user's systemd --user lingering -- so the home-manager renovate
|
|
# timer fires without an open login session -- is enabled from the host table
|
|
# in flake.nix (users.emmathorpe.linger = true) and applied by
|
|
# modules/users.nix.
|
|
|
|
# programs.nix-ld is enabled for all NixOS hosts in common-nixos.nix.
|
|
# This value determines the NixOS release from which the default
|
|
# settings for stateful data, like file locations and database versions
|
|
# on your system were taken. It's perfectly fine and recommended to leave
|
|
# this value at the release version of the first install of this system.
|
|
# Before changing this value read the documentation for this option
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
system.stateVersion = "24.11"; # Did you read the comment?
|
|
}
|