diff options
Diffstat (limited to 'hosts')
| -rw-r--r-- | hosts/ganymede/nixos.nix | 26 | ||||
| -rw-r--r-- | hosts/mercury/hjem.nix | 6 | ||||
| -rw-r--r-- | hosts/mercury/nixos.nix | 2 |
3 files changed, 27 insertions, 7 deletions
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index 5ceb4e6..14be488 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -15,8 +15,6 @@ ./caddy.nix ]; - # services.tailscale.extraSetFlags = ["--advertise-exit-node"]; - # backup usb teather configuration systemd.network.networks."80-usb-teather" = { name = "enp0s20f0u2"; @@ -58,6 +56,30 @@ }; }; + # deploy user + users.groups."deploy" = {}; + users.users."deploy" = { + isSystemUser = true; + group = "deploy"; + + openssh.authorizedKeys.keys = config.users.users."collin".openssh.authorizedKeys.keys; + }; + security.sudo.extraRules = [ + { + users = ["deploy"]; + commands = [ + { + command = "/nix/store/*/bin/switch-to-configuration"; + options = ["NOPASSWD"]; + } + { + command = "/run/current-system/sw/bin/shutdown"; + options = ["NOPASSWD"]; + } + ]; + } + ]; + services.fail2ban.enable = true; # merge logs from subdomains diff --git a/hosts/mercury/hjem.nix b/hosts/mercury/hjem.nix index 9e0ca77..793ee2a 100644 --- a/hosts/mercury/hjem.nix +++ b/hosts/mercury/hjem.nix @@ -30,11 +30,11 @@ in { captive-browser # https://words.filippo.io/captive-browser captiveBrowserDesktop - inputs.glide-browser.packages."x86_64-linux".default - inputs.vermilion.packages."x86_64-linux".default + # inputs.glide-browser.packages."x86_64-linux".default + # inputs.vermilion.packages."x86_64-linux".default # (pkgs.callPackage ../../pkgs/yoshi.nix {inherit inputs;}) - (pkgs.callPackage ../../pkgs/yo.nix {inherit inputs;}) + (pkgs.callPackage ../../pkgs/yo {inherit inputs;}) ]; files.".config/captive-browser.toml".text = '' diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index fee1a5e..932fdb0 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -30,8 +30,6 @@ } ]; - security.soteria.enable = true; - services.printing.enable = true; environment.defaultPackages = lib.mkForce []; # im not a noob |