85 lines
2.4 KiB
Nix
85 lines
2.4 KiB
Nix
{
|
|
lib,
|
|
namespace,
|
|
...
|
|
}:
|
|
with lib; rec {
|
|
mkHomeManagerConfigOpt = config:
|
|
mkOption {
|
|
# HM-compatible options taken from:
|
|
# https://github.com/nix-community/home-manager/blob/0ee5ab611dc1fbb5180bd7d88d2aeb7841a4d179/nixos/common.nix#L14
|
|
# NOTE: This has been adapted to support documentation generation without
|
|
# having home-manager options fully declared.
|
|
type = types.submoduleWith {
|
|
specialArgs =
|
|
{
|
|
osConfig = config;
|
|
modulesPath = "${inputs.home-manager or "/"}/modules";
|
|
}
|
|
// (config.home-manager.extraSpecialArgs or {});
|
|
modules =
|
|
[
|
|
({
|
|
lib,
|
|
modulesPath,
|
|
...
|
|
}:
|
|
if inputs ? home-manager
|
|
then {
|
|
imports = import "${modulesPath}/modules.nix" {
|
|
inherit pkgs lib;
|
|
useNixpkgsModule = !(config.home-manager.useGlobalPkgs or false);
|
|
};
|
|
|
|
config = {
|
|
submoduleSupport.enable = true;
|
|
submoduleSupport.externalPackageInstall = config.home-manager.useUserPackages;
|
|
|
|
home.username = config.users.users.${name}.name;
|
|
home.homeDirectory = config.users.users.${name}.home;
|
|
|
|
nix.package = config.nix.package;
|
|
};
|
|
}
|
|
else {})
|
|
]
|
|
++ (config.home-manager.sharedModules or []);
|
|
};
|
|
};
|
|
|
|
mkUser = {
|
|
config,
|
|
enable,
|
|
homeConfig,
|
|
username,
|
|
admin,
|
|
extraGroups,
|
|
trustedSshKeys,
|
|
}: let
|
|
impermanence = config.${namespace}.impermanence;
|
|
persist = impermanence.persistentStorage;
|
|
in {
|
|
snowfallorg.users.${username} = {
|
|
create = enable;
|
|
inherit admin;
|
|
|
|
home = {
|
|
enable = enable;
|
|
config = homeConfig;
|
|
};
|
|
};
|
|
users.users.${username} = mkIf enable {
|
|
extraGroups = extraGroups ++ optionals admin ["wheel"];
|
|
hashedPasswordFile = config.sops.secrets."users/${username}".path;
|
|
openssh.authorizedKeys.keys = trustedSshKeys;
|
|
};
|
|
sops.secrets."users/${username}" = mkIf enable {
|
|
neededForUsers = true;
|
|
};
|
|
systemd.tmpfiles.rules = optionals (impermanence.enable) ["d ${persist}/home/${username} 0700 ${username} users -"]; # /persist/home/<user> created, owned by that user
|
|
|
|
nix.settings.trusted-users = optionals admin [
|
|
username
|
|
];
|
|
};
|
|
}
|