From c29a14135736c2516bb5d951e6e97dc8143598db Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Tue, 3 Mar 2026 16:45:26 -0600
Subject: changes

---
 hosts/ganymede/nixos.nix | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

(limited to 'hosts/ganymede')

diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 5ceb4e6..14be488 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -15,8 +15,6 @@
     ./caddy.nix
   ];
 
-  # services.tailscale.extraSetFlags = ["--advertise-exit-node"];
-
   # backup usb teather configuration
   systemd.network.networks."80-usb-teather" = {
     name = "enp0s20f0u2";
@@ -58,6 +56,30 @@
     };
   };
 
+  # deploy user
+  users.groups."deploy" = {};
+  users.users."deploy" = {
+    isSystemUser = true;
+    group = "deploy";
+
+    openssh.authorizedKeys.keys = config.users.users."collin".openssh.authorizedKeys.keys;
+  };
+  security.sudo.extraRules = [
+    {
+      users = ["deploy"];
+      commands = [
+        {
+          command = "/nix/store/*/bin/switch-to-configuration";
+          options = ["NOPASSWD"];
+        }
+        {
+          command = "/run/current-system/sw/bin/shutdown";
+          options = ["NOPASSWD"];
+        }
+      ];
+    }
+  ];
+
   services.fail2ban.enable = true;
 
   # merge logs from subdomains
-- 
cgit v1.3.1