]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/users.nix
tor: improve type-checking and hardening (ter)
[sourcephile-nix.git] / machines / mermet / users.nix
1 { inputs, pkgs, lib, config, ... }:
2 let
3 inherit (builtins) readFile;
4 inherit (config.users) users;
5 in
6 {
7 imports = [
8 ../../members/julm.nix
9 ];
10
11 nix.trustedUsers = [
12 users."julm".name
13 ];
14
15 networking.nftables.ruleset = ''
16 add rule inet filter fw2net tcp dport {25,465} skuid ${users.julm.name} counter accept comment "SMTP"
17 add rule inet filter fw2net tcp dport 43 skuid ${users.julm.name} counter accept comment "Whois"
18 add rule inet filter fw2net tcp dport 563 skuid ${users.julm.name} counter accept comment "NNTPS"
19 add rule inet filter fw2net tcp dport 6697 skuid ${users.julm.name} counter accept comment "IRCS"
20 add rule inet filter fw2net tcp dport 11371 skuid ${users.julm.name} counter accept comment "HKP"
21 '';
22 users = {
23 mutableUsers = false;
24 users = {
25 root = {
26 openssh.authorizedKeys.keys = [
27 (readFile (inputs.secrets + "/machines/losurdo/ssh/root.ssh-ed25519.pub"))
28 ] ++ users."julm".openssh.authorizedKeys.keys;
29 };
30 backup = {
31 isSystemUser = true;
32 shell = users.root.shell;
33 openssh.authorizedKeys.keys = [
34 (readFile (inputs.secrets + "/machines/losurdo/ssh/backup.ssh-ed25519.pub"))
35 ] ++ users."julm".openssh.authorizedKeys.keys;
36 };
37 };
38 groups = {
39 wheel = {
40 members = [
41 users."julm".name
42 ];
43 };
44 };
45 };
46 }