nanuqsaurus/modules/users/admin.nix

{ lib, pkgs, ... }:

{
  users.groups = {
    docker = { };
    podman = { };
  };

  users.users.admin = {
    isNormalUser = true;
    extraGroups = [
      "wheel"
      "networkmanager"
      "podman"
      "docker"
      "libvirtd"
    ];
    hashedPassword = "$6$HrwFoHtYRwiTZsYo$gKNOvkQhjalczOLgoTXvVu1MaihYP4BdBnVpWkdoAf.5MAiV2mMPRibYyGv9ti1Q63AhGK7n4wOPjAU0O74mK0";
    subGidRanges = [
      {
        count = 65536;
        startGid = 100000;
      }
    ];
    subUidRanges = [
      {
        count = 65536;
        startUid = 100000;
      }
    ];
  };

  security.sudo.wheelNeedsPassword = lib.mkDefault true;

  # Bootstrap Home Manager for admin on first login (per-user, standalone)
  systemd.user.services.hm-bootstrap = {
    description = "One-time Home Manager bootstrap for admin";
    unitConfig = {
      ConditionPathExists = "!%h/.config/home-manager/.hm_bootstrap_done";
      After = [ "graphical-session.target" ];
      Wants = [ "graphical-session.target" ];
      PartOf = [ "graphical-session.target" ];
    };
    serviceConfig = {
      Type = "simple";
      TimeoutStartSec = "30min";
      Environment = [ "PATH=/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin" ];
      StandardOutput = "journal";
      StandardError = "journal";
      ExecStart = pkgs.writeShellScript "hm-bootstrap.sh" (
        builtins.readFile ../../scripts/hm-bootstrap.sh
      );
    };
    wantedBy = [ "graphical-session.target" ];
  };
}