forked from
lass.pds.lassul.us/superconfig
This repository has no description
default: use vars for password
author
lassulus
date
(Dec 5, 2024, 5:53 PM CET)
commit
cf364ae3
cf364ae324eb1d914bd38256813bccdb39e81574
parent
c8ef44b9
c8ef44b91a0a8e2f7ddc45128f776dbe9bb564f7
+15
-10
+15
-10
2configs/default.nix
+15
-10
2configs/default.nix
···
40
40
self.inputs.stockholm.nixosModules.ssh
41
41
self.inputs.stockholm.nixosModules.sync-containers3
42
42
{
43
-
users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
44
-
users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
43
+
# We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
44
+
users.extraUsers.mainUser.hashedPasswordFile =
45
+
config.clan.core.vars.generators.password.files.passwordHash.path;
46
+
users.extraUsers.root.hashedPasswordFile =
47
+
config.clan.core.vars.generators.password.files.passwordHash.path;
45
48
boot.initrd.systemd.emergencyAccess = true;
46
-
clanCore.facts.services.password = {
47
-
secret.password = { };
48
-
secret.passwordHash = { };
49
-
generator.path = with pkgs; [
49
+
clan.core.vars.generators.password = {
50
+
prompts.password.description = "Password for the main user";
51
+
files.password.deploy = false;
52
+
files.passwordHash.neededForUsers = true;
53
+
migrateFact = "password";
54
+
runtimeInputs = with pkgs; [
50
55
coreutils
51
-
xkcdpass
52
56
mkpasswd
53
57
];
54
-
generator.script = ''
55
-
xkcdpass -n 4 -d - > $secrets/password
56
-
cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
58
+
script = ''
59
+
cp $prompts/password $out/password
60
+
exit 1
61
+
cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
57
62
'';
58
63
};
59
64
}