51 lines
1.1 KiB
Nix
51 lines
1.1 KiB
Nix
{ username, ... }:
|
|
|
|
{
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
};
|
|
|
|
/*
|
|
* Sudo is scheduled to be replaced by systemd's run0.
|
|
* The blocker for this is persistent authentication support.
|
|
*
|
|
* https://github.com/systemd/systemd/issues/33366
|
|
* https://github.com/polkit-org/polkit/issues/472
|
|
*/
|
|
security.sudo = {
|
|
enable = true;
|
|
execWheelOnly = true;
|
|
extraConfig = ''
|
|
Defaults lecture="never"
|
|
'';
|
|
};
|
|
|
|
security.apparmor.enable = true;
|
|
networking.firewall.enable = true;
|
|
|
|
/* Disable the root user */
|
|
users = {
|
|
users.root.hashedPassword = "!";
|
|
mutableUsers = false;
|
|
};
|
|
|
|
sops.age.keyFile = "/nix/config/keys.txt";
|
|
|
|
environment.persistence."/nix/persist" = {
|
|
files = [
|
|
"/root/.ssh/known_hosts"
|
|
];
|
|
users."${username}".directories = let
|
|
baseAttrs = {
|
|
user = "${username}";
|
|
group = "users";
|
|
mode = "u=rwx,g=,o=";
|
|
};
|
|
in [
|
|
(baseAttrs // { directory = ".ssh"; })
|
|
(baseAttrs // { directory = ".local/share/gnupg"; })
|
|
(baseAttrs // { directory = ".local/share/keyrings"; })
|
|
];
|
|
};
|
|
}
|