mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat: enforce deterministic user and group ids

Browse source
This commit is contained in:
oddlama 2023-06-17 23:44:54 +02:00
parent b5d2d31b69
commit 9ed52a253c
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
4 changed files with 107 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/common/core/default.nix
View file

@ -12,6 +12,7 @@
../../../users/root
../../../modules/deteministic-ids.nix
../../../modules/distributed-config.nix
../../../modules/extra.nix
../../../modules/interface-naming.nix

8
hosts/common/core/impermanence.nix
View file

@ -131,6 +131,14 @@
group = "kanidm";
mode = "0700";
}
]
++ lib.optionals config.services.vaultwarden.enable [
{
directory = "/var/lib/vaultwarden";
user = "vaultwarden";
group = "vaultwarden";
mode = "0700";
}
];
};
}

17
hosts/common/core/system.nix
View file

@ -396,4 +396,21 @@
systemd.enableUnifiedCgroupHierarchy = true;
users.mutableUsers = false;
users.deterministicIds = let
uidGid = id: {
uid = id;
gid = id;
};
in {
systemd-oom = uidGid 999;
systemd-coredump = uidGid 998;
sshd = uidGid 997;
nscd = uidGid 996;
polkituser = uidGid 995;
microvm = uidGid 994;
promtail = uidGid 993;
grafana = uidGid 992;
acme = uidGid 991;
};
}