diff options
Diffstat (limited to 'hosts/ganymede/nixos.nix')
| -rw-r--r-- | hosts/ganymede/nixos.nix | 26 |
1 files changed, 24 insertions, 2 deletions
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index 5ceb4e6..14be488 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -15,8 +15,6 @@ ./caddy.nix ]; - # services.tailscale.extraSetFlags = ["--advertise-exit-node"]; - # backup usb teather configuration systemd.network.networks."80-usb-teather" = { name = "enp0s20f0u2"; @@ -58,6 +56,30 @@ }; }; + # deploy user + users.groups."deploy" = {}; + users.users."deploy" = { + isSystemUser = true; + group = "deploy"; + + openssh.authorizedKeys.keys = config.users.users."collin".openssh.authorizedKeys.keys; + }; + security.sudo.extraRules = [ + { + users = ["deploy"]; + commands = [ + { + command = "/nix/store/*/bin/switch-to-configuration"; + options = ["NOPASSWD"]; + } + { + command = "/run/current-system/sw/bin/shutdown"; + options = ["NOPASSWD"]; + } + ]; + } + ]; + services.fail2ban.enable = true; # merge logs from subdomains |