52 lines
1.5 KiB
Nix
52 lines
1.5 KiB
Nix
# Define an operator user for convenient interactive access to nix-bitcoin
|
|
# features and services.
|
|
#
|
|
# When using nix-bitcoin as part of a larger system config, set
|
|
# `nix-bitcoin.operator.name` to your main user name.
|
|
|
|
{ config, lib, pkgs, options, ... }:
|
|
|
|
with lib;
|
|
let
|
|
cfg = config.nix-bitcoin.operator;
|
|
in {
|
|
options.nix-bitcoin.operator = {
|
|
enable = mkEnableOption "operator user";
|
|
name = mkOption {
|
|
type = types.str;
|
|
default = "operator";
|
|
description = "User name.";
|
|
};
|
|
groups = mkOption {
|
|
type = with types; listOf str;
|
|
default = [];
|
|
description = "Extra groups.";
|
|
};
|
|
allowRunAsUsers = mkOption {
|
|
type = with types; listOf str;
|
|
default = [];
|
|
description = "Users as which the operator is allowed to run commands.";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
users.users.${cfg.name} = {
|
|
isNormalUser = true;
|
|
extraGroups = [
|
|
"systemd-journal"
|
|
"proc" # Enable full /proc access and systemd-status
|
|
] ++ cfg.groups;
|
|
};
|
|
|
|
security = mkIf (cfg.allowRunAsUsers != []) {
|
|
# Use doas instead of sudo if enabled
|
|
doas.extraConfig = mkIf config.security.doas.enable ''
|
|
${lib.concatMapStrings (user: "permit nopass ${cfg.name} as ${user}\n") cfg.allowRunAsUsers}
|
|
'';
|
|
sudo.extraConfig = mkIf (!config.security.doas.enable) ''
|
|
${cfg.name} ALL=(${builtins.concatStringsSep "," cfg.allowRunAsUsers}) NOPASSWD: ALL
|
|
'';
|
|
};
|
|
};
|
|
}
|