diff options
Diffstat (limited to 'os/core')
| -rw-r--r-- | os/core/bootloader.nix | 1 | ||||
| -rw-r--r-- | os/core/users.nix | 15 |
2 files changed, 14 insertions, 2 deletions
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix index 91502e9..e8dfc11 100644 --- a/os/core/bootloader.nix +++ b/os/core/bootloader.nix @@ -48,6 +48,7 @@ in }; }; + #TODO add boot.initrd.luks.reusePassphrases = true; somewhere luks.enable = lib.mkEnableOption "LUKS encryption support"; }; diff --git a/os/core/users.nix b/os/core/users.nix index 4bd0221..1ba471f 100644 --- a/os/core/users.nix +++ b/os/core/users.nix @@ -12,13 +12,24 @@ in options.os.core.users.enable = lib.mkEnableOption "enables user accounts"; config = lib.mkIf cfg.enable { programs.fish.enable = true; + assertions = [ + { + assertion = config.os.srv.sops.enable; + message = "required for storing the ssh key"; + } + ]; + sops.secrets = { + "users/root_password".neededForUsers = true; + "users/main_password".neededForUsers = true; + "users/opc_password".neededForUsers = true; + }; users = { mutableUsers = false; users = { "${username}" = { isNormalUser = true; - hashedPasswordFile = config.sops.secrets.user_password.path; + hashedPasswordFile = config.sops.secrets."users/main_password".path; shell = pkgs.fish; extraGroups = lib.mkMerge [ [ @@ -36,7 +47,7 @@ in (lib.mkIf (config.os.srv.docker.enable or false) [ "docker" ]) ]; }; - root.hashedPasswordFile = config.sops.secrets.root_password.path; + root.hashedPasswordFile = config.sops.secrets."users/root_password".path; }; }; }; |