diff options
| -rw-r--r-- | tv/1systems/wu.nix | 11 | ||||
| -rw-r--r-- | tv/1systems/xu.nix | 11 | ||||
| -rw-r--r-- | tv/2configs/base.nix | 3 | ||||
| -rw-r--r-- | tv/2configs/xserver/default.nix | 8 | ||||
| -rw-r--r-- | tv/2configs/z.nix | 40 |
5 files changed, 45 insertions, 28 deletions
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index b12e7df..fe6a5f3 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -32,6 +32,7 @@ with lib; ../2configs/git.nix ../2configs/mail-client.nix ../2configs/xserver + ../2configs/z.nix { environment.systemPackages = with pkgs; [ @@ -287,16 +288,6 @@ with lib; onion = { uid = 6660010; }; - - zalora = { - uid = 1000301; - extraGroups = [ - "audio" - # TODO remove vboxusers when hardening is active - "vboxusers" - "video" - ]; - }; }; security.sudo.extraConfig = diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index e2cc2c0..eb8c7c7 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -30,6 +30,7 @@ with lib; ../2configs/git.nix ../2configs/mail-client.nix ../2configs/xserver + ../2configs/z.nix { environment.systemPackages = with pkgs; [ @@ -286,16 +287,6 @@ with lib; onion = { uid = 6660010; }; - - zalora = { - uid = 1000301; - extraGroups = [ - "audio" - # TODO remove vboxusers when hardening is active - "vboxusers" - "video" - ]; - }; }; security.sudo.extraConfig = diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix index a74ce32..4beece5 100644 --- a/tv/2configs/base.nix +++ b/tv/2configs/base.nix @@ -23,6 +23,9 @@ with lib; (import <secrets/hashedPasswords.nix>); } { + users.groups.subusers.gid = 1093178926; # genid subusers + } + { users.defaultUserShell = "/run/current-system/sw/bin/bash"; users.mutableUsers = false; } diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index 4d2fe9e..df00203 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -70,14 +70,6 @@ let ExecStart = "${xserver}/bin/xserver"; }; }; - - programs.bash.interactiveShellInit = '' - case ''${XMONAD_SPAWN_WORKSPACE-} in - za|zh|zj|zs) - exec sudo -u zalora -i - ;; - esac - ''; }; xmonad-environment = { diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix new file mode 100644 index 0000000..e5494ec --- /dev/null +++ b/tv/2configs/z.nix @@ -0,0 +1,40 @@ +{ config, lib, pkgs, ... }: + +with lib; + +{ + krebs.per-user.z.packages = [ + (pkgs.writeScriptBin "cr" '' + #! /bin/sh + set -efu + export LC_TIME=de_DE.utf8 + exec ${pkgs.chromium}/bin/chromium \ + --ssl-version-min=tls1 \ + --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ + --disk-cache-size=50000000 \ + "%@" + '') + ]; + + programs.bash.interactiveShellInit = '' + case ''${XMONAD_SPAWN_WORKSPACE-} in + za|zh|zj|zs) + exec sudo -u z -i + ;; + esac + ''; + + security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL"; + + users.users.z = { + extraGroups = [ + "audio" + "vboxusers" + "video" + ]; + group = "subusers"; + home = "/home/z"; + uid = 3043726074; # genid z + useDefaultShell = true; + }; +} |