extern/nix-config
1
0
Fork 1
mirror of https://github.com/donovanglover/nix-config.git synced 2025-06-13 05:06:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

system: Disable root for containers by default

Browse Source 
Notably removes the ability for non-containers to easily have root
disabled, although this shouldn't be wanted in most cases.
This commit is contained in:
Donovan Glover 2024-09-02 12:18:15 -04:00
parent 4c301830d5
commit 1b71076ca1
No known key found for this signature in database
GPG Key ID: EA7408A77AE1BE65
2 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
containers/default.nix
View File

@ -19,10 +19,6 @@
nixpkgs.overlays = builtins.attrValues nix-config.overlays; nixpkgs.overlays = builtins.attrValues nix-config.overlays;
modules = {
system.noRoot = true;
};
environment = { environment = {
variables = { variables = {
TERM = "xterm-kitty"; TERM = "xterm-kitty";

9
modules/system.nix
View File

@ -8,6 +8,7 @@
let let
inherit (lib.types) nullOr str listOf; inherit (lib.types) nullOr str listOf;
inherit (config.boot) isContainer;
inherit (lib) inherit (lib)
mkOption mkOption
@ -25,7 +26,6 @@ let
allowSRB2Port allowSRB2Port
allowDevPort allowDevPort
phone phone
noRoot
postgres postgres
; ;
@ -76,7 +76,6 @@ in
}; };
iHaveLotsOfRam = mkEnableOption "tmpfs on /tmp"; iHaveLotsOfRam = mkEnableOption "tmpfs on /tmp";
noRoot = mkEnableOption "disable access to root";
mullvad = mkEnableOption "mullvad vpn"; mullvad = mkEnableOption "mullvad vpn";
postgres = mkEnableOption "postgres database for containers"; postgres = mkEnableOption "postgres database for containers";
allowSRB2Port = mkEnableOption "port for srb2"; allowSRB2Port = mkEnableOption "port for srb2";
@ -148,17 +147,17 @@ in
users = { users = {
mutableUsers = false; mutableUsers = false;
allowNoPasswordLogin = mkIf noRoot true; allowNoPasswordLogin = mkIf isContainer true;
users.${username} = { users.${username} = {
inherit hashedPassword; inherit hashedPassword;
isNormalUser = true; isNormalUser = true;
uid = 1000; uid = 1000;
password = mkIf (hashedPassword == null && !noRoot) (if phone then "1234" else username); password = mkIf (hashedPassword == null && !isContainer) (if phone then "1234" else username);
extraGroups = extraGroups =
if noRoot then if isContainer then
[ ] [ ]
else else
[ [