extern/nix-config
1
0
Fork 1
mirror of https://github.com/donovanglover/nix-config.git synced 2024-11-22 00:03:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

system: Disable root for containers by default

Browse Source 
Notably removes the ability for non-containers to easily have root
disabled, although this shouldn't be wanted in most cases.
This commit is contained in:
Donovan Glover 2024-09-02 12:18:15 -04:00
parent 4c301830d5
commit 1b71076ca1
No known key found for this signature in database
GPG Key ID: EA7408A77AE1BE65
2 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
containers/default.nix
View File

@ -19,10 +19,6 @@
nixpkgs.overlays = builtins.attrValues nix-config.overlays;
modules = {
system.noRoot = true;
};
environment = {
variables = {
TERM = "xterm-kitty";

9
modules/system.nix
View File

@ -8,6 +8,7 @@
let
inherit (lib.types) nullOr str listOf;
inherit (config.boot) isContainer;
inherit (lib)
mkOption
@ -25,7 +26,6 @@ let
allowSRB2Port
allowDevPort
phone
noRoot
postgres
;
@ -76,7 +76,6 @@ in
};
iHaveLotsOfRam = mkEnableOption "tmpfs on /tmp";
noRoot = mkEnableOption "disable access to root";
mullvad = mkEnableOption "mullvad vpn";
postgres = mkEnableOption "postgres database for containers";
allowSRB2Port = mkEnableOption "port for srb2";
@ -148,17 +147,17 @@ in
users = {
mutableUsers = false;
allowNoPasswordLogin = mkIf noRoot true;
allowNoPasswordLogin = mkIf isContainer true;
users.${username} = {
inherit hashedPassword;
isNormalUser = true;
uid = 1000;
password = mkIf (hashedPassword == null && !noRoot) (if phone then "1234" else username);
password = mkIf (hashedPassword == null && !isContainer) (if phone then "1234" else username);
extraGroups =
if noRoot then
if isContainer then
[ ]
else
[