79 lines
1.9 KiB
Nix
79 lines
1.9 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.nanuqsaurus.admin;
|
|
in
|
|
{
|
|
options.nanuqsaurus.admin = {
|
|
username = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "admin";
|
|
description = "Primary admin user account name.";
|
|
};
|
|
};
|
|
|
|
config = {
|
|
users.groups = {
|
|
docker = { };
|
|
podman = { };
|
|
};
|
|
|
|
users.users.${cfg.username} = {
|
|
isNormalUser = true;
|
|
extraGroups = [
|
|
"wheel"
|
|
"networkmanager"
|
|
"podman"
|
|
"docker"
|
|
"libvirtd"
|
|
"lpadmin"
|
|
];
|
|
hashedPassword = "$6$HrwFoHtYRwiTZsYo$gKNOvkQhjalczOLgoTXvVu1MaihYP4BdBnVpWkdoAf.5MAiV2mMPRibYyGv9ti1Q63AhGK7n4wOPjAU0O74mK0";
|
|
subGidRanges = [
|
|
{
|
|
count = 65536;
|
|
startGid = 100000;
|
|
}
|
|
];
|
|
subUidRanges = [
|
|
{
|
|
count = 65536;
|
|
startUid = 100000;
|
|
}
|
|
];
|
|
};
|
|
|
|
security.sudo.wheelNeedsPassword = lib.mkDefault true;
|
|
|
|
# Bootstrap Home Manager for the primary admin user on first login (per-user, standalone)
|
|
systemd.user.services.hm-bootstrap = {
|
|
description = "One-time Home Manager bootstrap";
|
|
unitConfig = {
|
|
ConditionPathExists = "!%h/.config/home-manager/.hm_bootstrap_done";
|
|
After = [ "graphical-session.target" ];
|
|
Wants = [ "graphical-session.target" ];
|
|
PartOf = [ "graphical-session.target" ];
|
|
};
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
TimeoutStartSec = "30min";
|
|
Environment = [
|
|
"PATH=/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin"
|
|
"NANUQSAURUS_ADMIN_USER=${cfg.username}"
|
|
"NANUQSAURUS_HM_TARGET=${cfg.username}"
|
|
];
|
|
StandardOutput = "journal";
|
|
StandardError = "journal";
|
|
ExecStart = pkgs.writeShellScript "hm-bootstrap.sh" (
|
|
builtins.readFile ../../scripts/hm-bootstrap.sh
|
|
);
|
|
};
|
|
wantedBy = [ "graphical-session.target" ];
|
|
};
|
|
};
|
|
}
|