Finalize working configs and prior to adding secrets

System configurations in a known good state. Secrets still have to be
integrated, at this point the nixos-anywhere project will likely handle
this to keep the bootstrap completely automatic since it can copy ssh
host keys to the host prior to install/activation. This would work
nicely with the sops secret module, but a good way to manage host keys
for each machine still has to be decided.

1 files changed, 48 insertions, 36 deletions

diff --git a/modules/xnet/users.nix b/modules/xnet/users.nix
index d9f6081..53aa15b 100644
--- a/modules/xnet/users.nix
+++ b/modules/xnet/users.nix
@@ -14,48 +14,60 @@ in
   };
 
   config = {
-    users.mutableUsers = false;
+    users = {
+      mutableUsers = false;
+      users.kle = mkIf (builtins.elem "kle" cfg.enable) {
+        hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
+        isNormalUser = true;
+        createHome = true;
+        extraGroups = [ "wheel" "users" "networkmanager" "video" ];
+        packages = with pkgs; [
+          btop
+          curl
+          fzf
+          jq
+          lynx
+          neovim
+          ranger
+          rsync
+          sshfs
+          tree
+          zip
+        ];
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
+        ];
+      };
+    };
 
-    users.users.kle = mkIf (builtins.elem "kle" cfg.enable) {
-      hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
-      isNormalUser = true;
-      createHome = true;
-      extraGroups = [ "wheel" "users" "networkmanager" "video" ];
-      packages = with pkgs; [
-        btop
-        curl
-        fzf
-        git
-        jq
-        lynx
-        neovim
-        ranger
-        rsync
-        sshfs
-        tree
-        zip
-      ];
+    security.sudo = {
+      execWheelOnly = true;
+      extraConfig = "Defaults lecture = never";
     };
 
-    programs.ssh.extraConfig = ''
-      Host github
-        HostName github.com
-        User git
-        PreferredAuthentications publickey
-    '';
+    programs.ssh = {
+      knownHosts = {
+        "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+      };
+      extraConfig = ''
+        Host github
+          HostName github.com
+          User git
+          PreferredAuthentications publickey
+      '';
+    };
 
     programs.git = {
       config = {
-        init = {
-          defaultBranch = "master";
-        };
-        push = {
-          default = "upstream";
-          autoSetupRemote = true;
-        };
-        fetch = {
-          prune = true;
-        };
+        init.defaultBranch = "master";
+        fetch.prune = true;
+        core.excludesFile = pkgs.writeText "gitignore" ''
+          # dev shell caching
+          .direnv/
+          .envrc
+        '';
+        push.default = "upstream";
+        push.autoSetupRemote = true;
       };
     };
   };