rrvsh/pantheon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(nixos): add user password secrets to sops

Browse source 
This commit adds the user password secrets to sops.
It leverages the `userListToAttrs` lib function.
This commit is contained in:
Mohammad Rafiq 2025-07-07 17:26:57 +08:00
parent 782a4324a8
commit 4ff7b8e18f
No known key found for this signature in database
5 changed files with 42 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/modules/users.nix
View file

@ -1,7 +1,7 @@
{ config, lib, ... }:
let
cfg = config.flake;
inherit (cfg.lib.modules) forAllUsers';
inherit (cfg.lib.modules) userListToAttrs forAllUsers';
inherit (lib.lists) optional;
in
{
@ -19,13 +19,20 @@ in
mutableUsers = false;
groups.users.gid = 100;
users = forAllUsers' (
_: value: {
name: value: {
isNormalUser = true;
hashedPasswordFile = config.sops.secrets."${name}/hashedPassword".path;
extraGroups = optional (value.primary or false) "wheel";
openssh.authorizedKeys.keys = [ value.pubkey ];
}
);
};
sops.secrets = userListToAttrs (name: {
"${name}/hashedPassword" = {
neededForUsers = true;
sopsFile = cfg.paths.secrets + "/users.yaml";
};
});
home-manager.users = forAllUsers' (
name: _: {
home.username = name;