users: factorize rights

diff --git a/machines/losurdo/users.nix b/machines/losurdo/users.nix
index 2fb8531142a6142a915a46aec0a5863609ded13b..3cf81d08d1ce61d9bed07c4402c3aa00d9800da7 100644 (file)
--- a/machines/losurdo/users.nix
+++ b/machines/losurdo/users.nix
@@ -1,4 +1,4 @@
-{ inputs, pkgs, lib, config, machineName, ... }:
+{ inputs, pkgs, lib, config, ... }:
 let
   inherit (config.security) gnupg;
   inherit (config.users) users;
@@ -12,19 +12,6 @@ nix.trustedUsers = [
   users."julm".name
 ];
 
-networking.nftables.ruleset = lib.concatMapStringsSep "\n"
-  (rule: "add rule inet filter fw2net meta skuid ${users.julm.name} " + rule) [
-  ''tcp dport {25,465} counter accept comment "SMTP"''
-  ''tcp dport 43 counter accept comment "Whois"''
-  ''tcp dport 993 counter accept comment "IMAPS"''
-  ''tcp dport 6697 counter accept comment "IRCS"''
-  ''tcp dport 5222 counter accept comment "XMPP"''
-  ''tcp dport 11371 counter accept comment "HKP"''
-  ''tcp dport {9009,9010,9011,9012,9013} counter accept comment "croc"''
-  ''udp dport 33434-33523 counter accept comment "traceroute"''
-  #''ip protocol tcp counter accept comment "all"''
-];
-
 users = {
   mutableUsers = false;
   users = {
@@ -35,19 +22,35 @@ users = {
     };
   };
   groups = {
-    wheel = {
-      members = [ users."julm".name ];
-    };
-    tor = {
-      members = [ users."julm".name ];
-    };
-    adbusers = {
-      members = [ users."julm".name ];
-    };
+    adbusers.members = [
+      users."julm".name
+    ];
+    dialout.members = [
+      users."julm".name
+    ];
+    tor.members = [
+      users."julm".name
+    ];
+    wheel.members = [
+      users."julm".name
+    ];
   };
 };
 
 security.gnupg.secrets."/root/.ssh/id_ed25519" = {
   gpg = "${gnupg.store}/ssh/root.ssh-ed25519.gpg";
 };
+
+networking.nftables.ruleset = lib.concatMapStringsSep "\n"
+  (rule: "add rule inet filter fw2net meta skuid ${users.julm.name} " + rule) [
+  ''tcp dport {25,465} counter accept comment "SMTP"''
+  ''tcp dport 43 counter accept comment "Whois"''
+  ''tcp dport 993 counter accept comment "IMAPS"''
+  ''tcp dport 6697 counter accept comment "IRCS"''
+  ''tcp dport 5222 counter accept comment "XMPP"''
+  ''tcp dport 11371 counter accept comment "HKP"''
+  ''tcp dport {9009,9010,9011,9012,9013} counter accept comment "croc"''
+  ''udp dport 33434-33523 counter accept comment "traceroute"''
+  #''ip protocol tcp counter accept comment "all"''
+];
 }

diff --git a/machines/mermet/users.nix b/machines/mermet/users.nix
index 7b5a94781b48dfeddfa53d6a4ca72284158fb099..188a1525b3020887292c283f01589bac839636c2 100644 (file)
--- a/machines/mermet/users.nix
+++ b/machines/mermet/users.nix
@@ -8,21 +8,32 @@ imports = [
   ../../members/julm.nix
 ];
 
-networking.nftables.ruleset = ''
-  add rule inet filter fw2net tcp dport {25,465} skuid ${users.julm.name} counter accept comment "SMTP"
-  add rule inet filter fw2net tcp dport 43 skuid ${users.julm.name} counter accept comment "Whois"
-  add rule inet filter fw2net tcp dport 563 skuid ${users.julm.name} counter accept comment "NNTPS"
-  add rule inet filter fw2net tcp dport 6697 skuid ${users.julm.name} counter accept comment "IRCS"
-  add rule inet filter fw2net tcp dport 11371 skuid ${users.julm.name} counter accept comment "HKP"
-'';
+nix.trustedUsers = [
+  users."julm".name
+];
+
 users = {
   mutableUsers = false;
   users = {
     root = {
-      openssh.authorizedKeys.keys = [
-        (readFile (inputs.secrets + "/machines/losurdo/ssh/root.ssh-ed25519.pub"))
-      ];
+      openssh.authorizedKeys.keys =
+        users."julm".openssh.authorizedKeys.keys ++
+        [ (readFile (inputs.secrets + "/machines/losurdo/ssh/root.ssh-ed25519.pub")) ];
+      hashedPassword = "!";
     };
   };
+  groups = {
+    wheel.members = [
+      users."julm".name
+    ];
+  };
 };
+
+networking.nftables.ruleset = ''
+  add rule inet filter fw2net tcp dport {25,465} skuid ${users.julm.name} counter accept comment "SMTP"
+  add rule inet filter fw2net tcp dport 43 skuid ${users.julm.name} counter accept comment "Whois"
+  add rule inet filter fw2net tcp dport 563 skuid ${users.julm.name} counter accept comment "NNTPS"
+  add rule inet filter fw2net tcp dport 6697 skuid ${users.julm.name} counter accept comment "IRCS"
+  add rule inet filter fw2net tcp dport 11371 skuid ${users.julm.name} counter accept comment "HKP"
+'';
 }

diff --git a/members/julm.nix b/members/julm.nix
index a15f9274ee68f6cdf9ff23e4b9bf376bc8591b64..1cadb082c809510f11d9eed33341740b0cd8626e 100644 (file)
--- a/members/julm.nix
+++ b/members/julm.nix
@@ -17,11 +17,6 @@ users.users.julm = {
   uid = 1000;
   #uid = userLib.mkUid "julm";
 };
-nix.trustedUsers = [ users."julm".name ];
-users.users.root = {
-  openssh.authorizedKeys.keys = users."julm".openssh.authorizedKeys.keys;
-};
-users.groups.wheel.members = [ users."julm".name ];
 environment.systemPackages = [
   pkgs.neomutt # hack until neomutt becomes installable by home-manager again
 ];