user updates

modules/nixos/apps/free-games-claimer/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, namespace, ... }:
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
 with lib;
 let
   cfg = config.${namespace}.services.free-games-claimer;

modules/nixos/apps/manyfold/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, namespace, ... }:
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
 with lib;
 let
   cfg = config.${namespace}.services.manyfold;

modules/nixos/apps/mongodb/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, namespace, ... }:
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
 with lib;
 let
   cfg = config.${namespace}.services.mongodb;

modules/nixos/apps/tdarr/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, namespace, ... }:
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
 with lib;
 let
   cfg = config.${namespace}.services.tdarr;

modules/nixos/apps/your-spotify/default.nix

@@ -1,4 +1,9 @@
-{ lib, config, namespace, ... }:
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
 with lib;
 let
   cfg = config.${namespace}.services.your_spotify;

modules/nixos/disko/options.nix

@@ -4,7 +4,10 @@ with lib;
   options.${namespace}.hardware.disko = {
     enable = mkEnableOption "enable disko";
     filesystem = mkOption {
-      type = types.enum [ "bcachefs" "btrfs" ];
+      type = types.enum [
+        "bcachefs"
+        "btrfs"
+      ];
       default = "btrfs";
       description = "Filesystem to use for the root partition";
     };

modules/nixos/gitea/default.nix

@@ -1,4 +1,9 @@
-{ config, lib, namespace, ... }:
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
 with lib;
 let
   cfg = config.${namespace}.services.gitea;

modules/nixos/impermanence/default.nix

@@ -1,4 +1,3 @@
-
 {
   config,
   lib,
@@ -105,7 +104,9 @@ in
       {
         assertion =
           if hasAttr "/" config.fileSystems then
-            config.fileSystems."/".fsType == "btrfs" || config.fileSystems."/".fsType == "bcachefs" || config.fileSystems."/".fsType == "tmpfs"
+            config.fileSystems."/".fsType == "btrfs"
+            || config.fileSystems."/".fsType == "bcachefs"
+            || config.fileSystems."/".fsType == "tmpfs"
           else
             false;
         message = "rootfs must be btrfs, bcachefs, or tmpfs; not " + config.fileSystems."/".fsType;
@@ -113,7 +114,10 @@ in
 
       {
         assertion =
-          if hasAttr "/" config.fileSystems && (config.fileSystems."/".fsType == "btrfs" || config.fileSystems."/".fsType == "bcachefs") then
+          if
+            hasAttr "/" config.fileSystems
+            && (config.fileSystems."/".fsType == "btrfs" || config.fileSystems."/".fsType == "bcachefs")
+          then
             any (
               t: t == "subvol=root" || t == "subvol=/root" || t == "X-mount.subdir=subvolumes/root"
             ) config.fileSystems."/".options

modules/nixos/network/default.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   namespace,
   ...
 }:
@@ -87,8 +86,7 @@ in
               config.sops.secrets.wifi.path
             ];
 
-            profiles = mapAttrs 
+            profiles = mapAttrs (name: profile: {
-              (name: profile: {
               connection = {
                 id = name;
                 type = "wifi";
@@ -117,8 +115,7 @@ in
                 key-mgmt = profile.keyMgmt;
                 psk = profile.psk;
               };
-              })
+            }) cfg.wifi.profiles;
-              cfg.wifi.profiles;
           };
         })
       ];

modules/nixos/network/options.nix

@@ -109,7 +109,8 @@ with lib;
         description = "Whether to enable WiFi power saving.";
       };
       profiles = mkOption {
-        type = types.attrsOf (types.submodule {
+        type = types.attrsOf (
+          types.submodule {
             options = {
               ssid = mkOption {
                 type = types.str;
@@ -126,7 +127,8 @@ with lib;
                 description = "Key management type (e.g., sae, wpa-psk).";
               };
             };
-        });
+          }
+        );
         default = { };
         description = "WiFi network profiles.";
       };

modules/nixos/user/default.nix

@@ -8,6 +8,18 @@
 with lib;
 let
   cfg = config.${namespace}.user;
+
+  isRoot = (cfg.name == "root");
+
+  # Common SSH keys used across systems
+  commonSshKeys = [
+    # MacBook
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCw9zq8DLGByI5v2gAn95hKNyOsm3g61a2buxu2BBMFysQJgmZPCCLUqRJKhSM5Vm/JOgsAmdpRBRZQoHD+6S844CJHb4v4VIbjkyQgYCuM7Rst2IOZ5QybvsA2/D0nwytZ+HXQqDj2AagUYDbz0gyyIHkDQ5YGBMkvkWz/h1Vci6aoBM7VihEDM4KlWoTVuPeASGM8r5IZ2FS83Djbqo4ov6AYvLMrKB9Z7hmFgH6R3LE0gxOkzbGVXtSuvJyrjvgytoT22UhATjjxSQ9D+YJXXkQoB3lUdg8OoIquUPjMZpl4mR8ffvseWPfcvD1XlD5t+TOHFqKpESO547tlOBYhdpew+NSgAXpamCU6oyV8tDCywLQu2ucxHRn78u6WXzWHkDtffdhzmk6TZaPhWqVHuTGjR4higBgGqUfSaKOMszt+FDRZAr3HtuQ2+zJ8bowK9fW5OqilTtK2HtQqroD9ApegDNbqOz6kGy5IycSXvqPURy/M4lxZxbtBPuemcJs= mattjallen@MacBook-Pro.local"
+    # Desktop Windows
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ2PYPjZddOzR8OJj16G88KcUhCDLkvrEmpUQP0wKHDUuA27HQQ2ORo66asadwGHY3k1VDZ1ei9l9H++SIIeKOaaUr5yZdktvj4POUNtbd9ZhcS7sZU7BSF+NMDM+h3tImh6z0S7mWvRQOUv3ZM+ZER+5xTWJVG1OOJEpb1drxJk6Qz0wbZKSR7TPNFBLLXlVy7hkNYf07RtDyhCCxNB3hJfa8c+oztnWumwDhDQWLqiUXWIU2QH6iRLGl/WYnujtNvVVaV/Hn3JJkS6MM9dnV3cpoIO0+J7+WfsN9rZ0wXt5yY3GhiGXwmcO5eYVli8lHlLWtK7aYSETyry6CBsLbojzOQO5rSqhpwfF2njAAFAQU0UjLc8PahisIuFKCwHH4iyXXOagiv5K1Mc/0Ak+WhhMPee6vV2p7NTyNpXRvouDbWy5cSRH31WgQ9fK5mIGe5v8nGGqtEhUubUkiOgP+H3UbT2V/nTv/TFKdJcKw+WmizvTrxBmaMjWALlkYl+s= mattl@Jallen-PC"
+    # Desktop NixOS
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTBMydhOc6SnOdB5WrEd7X07DrboAtagCUgXiOJjLov matt@matt-nixos"
+  ];
 in
 {
   options.${namespace}.user = with types; {
@@ -41,11 +53,58 @@ in
       default = null;
       description = "Path to the password file for this user account";
     };
+    sshKeys = lib.mkOption {
+      type = listOf str;
+      default = [ ];
+      description = "List of SSH public keys for the user.";
+    };
+    enableCommonSshKeys = lib.mkOption {
+      type = bool;
+      default = true;
+      description = "Whether to include common SSH keys used across systems.";
+    };
+    uid = lib.mkOption {
+      type = int;
+      default = if isRoot then ids.uids.root else 1000;
+      description = "The user ID for the user account.";
+    };
+    packages = lib.mkOption {
+      type = listOf package;
+      default = [ ];
+      description = "List of packages to install for this user.";
+    };
+    linger = lib.mkOption {
+      type = bool;
+      default = false;
+      description = "Whether to enable systemd user service persistence.";
+    };
+    password = lib.mkOption {
+      type = nullOr str;
+      default = null;
+      description = "Plain text password for the user (development only).";
+    };
+    hashedPassword = lib.mkOption {
+      type = nullOr str;
+      default = null;
+      description = "Hashed password for the user.";
+    };
+    mutableUsers = lib.mkOption {
+      type = bool;
+      default = false;
+      description = "Whether users are mutable (can be modified after creation).";
+    };
   };
 
   config = {
+    users.mutableUsers = cfg.mutableUsers;
+
     users.users.${cfg.name} = {
-      inherit (cfg) name;
+      inherit (cfg)
+        name
+        uid
+        linger
+        packages
+        ;
 
       extraGroups = [
         "wheel"
@@ -69,10 +128,21 @@ in
 
       group = "users";
       home = "/home/${cfg.name}";
-      isNormalUser = true;
+      isNormalUser = (!isRoot);
+      isSystemUser = isRoot;
       shell = lib.mkForce pkgs.zsh;
-      uid = 1000;
+
-      hashedPasswordFile = cfg.passwordFile;
+      # SSH keys - combine user-specific and common keys
+      openssh.authorizedKeys.keys = cfg.sshKeys ++ (lib.optionals cfg.enableCommonSshKeys commonSshKeys);
+
+      # Authentication - priority: passwordFile > hashedPassword > password
+      hashedPasswordFile = lib.mkIf (cfg.passwordFile != null) cfg.passwordFile;
+      hashedPassword = lib.mkIf (
+        cfg.passwordFile == null && cfg.hashedPassword != null
+      ) cfg.hashedPassword;
+      password = lib.mkIf (
+        cfg.passwordFile == null && cfg.hashedPassword == null && cfg.password != null
+      ) cfg.password;
     }
     // cfg.extraOptions;
   };

systems/aarch64-linux/macbook-pro-nixos/default.nix

@@ -26,6 +26,25 @@ in
   };
 
   ${namespace} = {
+    user = {
+      name = "matt";
+      extraGroups = [
+        "ratbagd"
+        "input"
+        "scanner"
+        "lp"
+        "video"
+        "i2c"
+      ];
+      packages = with pkgs; [
+        firefox
+        tree
+        git
+        box64
+        prismlauncher
+        distrobox
+      ];
+    };
     desktop = {
       hyprland = {
         enable = true;
@@ -85,31 +104,6 @@ in
 
   nixpkgs.config.allowUnsupportedSystem = true;
 
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.matt = {
-    isNormalUser = true;
-    extraGroups = [
-      "wheel"
-      "keys"
-      "networkmanager"
-      "ratbagd"
-      "input"
-      "scanner"
-      "lp"
-      "video"
-      "i2c"
-    ]; # Enable ‘sudo’ for the user.
-    shell = pkgs.zsh;
-    packages = with pkgs; [
-      firefox
-      tree
-      git
-      box64
-      prismlauncher
-      distrobox
-    ];
-  };
-
   virtualisation = {
     containers.enable = true;
     podman.enable = true;

systems/aarch64-linux/pi4/default.nix

@@ -9,8 +9,6 @@
   ...
 }:
 let
-  user = "matt";
-  # password = config.sops.secrets."pi4/matt-password".path;
   kernelBundle = pkgs.linuxAndFirmware.latest;
 in
 {
@@ -23,6 +21,15 @@ in
 
   ${namespace} = {
     hardware.disko.enable = true;
+    user = {
+      name = "matt";
+      password = "BogieDudie1";
+      mutableUsers = false;
+      extraGroups = [
+        "docker"
+        "video"
+      ];
+    };
     network = {
       hostName = "pi4";
       ipv4 = {
@@ -80,36 +87,12 @@ in
     ];
   };
 
-  users = {
+  # Root user configuration - explicit to avoid conflicts with home-manager
-    mutableUsers = false;
+  users.users.root = {
-    users = {
-      "${user}" = {
-        isNormalUser = true;
-        # hashedPasswordFile = password;
-        password = lib.mkForce "BogieDudie1";
-        extraGroups = [
-          "wheel"
-          "docker"
-          "video"
-        ];
-        shell = pkgs.zsh;
-        openssh.authorizedKeys.keys = [
-          # macBook
-          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCw9zq8DLGByI5v2gAn95hKNyOsm3g61a2buxu2BBMFysQJgmZPCCLUqRJKhSM5Vm/JOgsAmdpRBRZQoHD+6S844CJHb4v4VIbjkyQgYCuM7Rst2IOZ5QybvsA2/D0nwytZ+HXQqDj2AagUYDbz0gyyIHkDQ5YGBMkvkWz/h1Vci6aoBM7VihEDM4KlWoTVuPeASGM8r5IZ2FS83Djbqo4ov6AYvLMrKB9Z7hmFgH6R3LE0gxOkzbGVXtSuvJyrjvgytoT22UhATjjxSQ9D+YJXXkQoB3lUdg8OoIquUPjMZpl4mR8ffvseWPfcvD1XlD5t+TOHFqKpESO547tlOBYhdpew+NSgAXpamCU6oyV8tDCywLQu2ucxHRn78u6WXzWHkDtffdhzmk6TZaPhWqVHuTGjR4higBgGqUfSaKOMszt+FDRZAr3HtuQ2+zJ8bowK9fW5OqilTtK2HtQqroD9ApegDNbqOz6kGy5IycSXvqPURy/M4lxZxbtBPuemcJs= mattjallen@MacBook-Pro.local"
-          # desktop windows
-          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ2PYPjZddOzR8OJj16G88KcUhCDLkvrEmpUQP0wKHDUuA27HQQ2ORo66asadwGHY3k1VDZ1ei9l9H++SIIeKOaaUr5yZdktvj4POUNtbd9ZhcS7sZU7BSF+NMDM+h3tImh6z0S7mWvRQOUv3ZM+ZER+5xTWJVG1OOJEpb1drxJk6Qz0wbZKSR7TPNFBLLXlVy7hkNYf07RtDyhCCxNB3hJfa8c+oztnWumwDhDQWLqiUXWIU2QH6iRLGl/WYnujtNvVVaV/Hn3JJkS6MM9dnV3cpoIO0+J7+WfsN9rZ0wXt5yY3GhiGXwmcO5eYVli8lHlLWtK7aYSETyry6CBsLbojzOQO5rSqhpwfF2njAAFAQU0UjLc8PahisIuFKCwHH4iyXXOagiv5K1Mc/0Ak+WhhMPee6vV2p7NTyNpXRvouDbWy5cSRH31WgQ9fK5mIGe5v8nGGqtEhUubUkiOgP+H3UbT2V/nTv/TFKdJcKw+WmizvTrxBmaMjWALlkYl+s= mattl@Jallen-PC"
-          # desktop nixos
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTBMydhOc6SnOdB5WrEd7X07DrboAtagCUgXiOJjLov matt@matt-nixos"
-        ];
-      };
-
-      root = {
     isSystemUser = true;
     isNormalUser = false;
     shell = pkgs.zsh;
   };
-    };
-  };
 
   programs = {
     kdeconnect.enable = false;

systems/aarch64-linux/pi4/networking.nix

@@ -1,7 +1,4 @@
 { lib, config, ... }:
-let
-  hostname = "pi4";
-in
 {
   # Networking configs
   networking = {

systems/aarch64-linux/pi5/default.nix

@@ -10,8 +10,6 @@
   ...
 }:
 let
-  user = "matt";
-  # password = config.sops.secrets."pi5/matt-password".path;
   kernelBundle = pkgs.linuxAndFirmware.latest;
 in
 {
@@ -25,6 +23,16 @@ in
   ${namespace} = {
     hardware.disko.enable = true;
     desktop.hyprland.enable = false;
+    user = {
+      name = "matt";
+      password = "BogieDudie1";
+      mutableUsers = false;
+      extraGroups = [ "docker" ];
+      sshKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTha0FbV1tkpnJr7xVH78S5MetJH+0o2YrEcuvhL692 root@jallen-nas"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIwoHWOLSTGVif9hAhaMLl0qDA4roIzCNuyR6kyIXDOj admin@jallen-nas"
+      ];
+    };
     network = {
       hostName = "pi5";
       ipv4 = {
@@ -89,30 +97,8 @@ in
 
   hardware.graphics.enable32Bit = lib.mkForce false;
 
-  users = {
+  # Root user configuration
-    mutableUsers = false;
+  users.users.root.shell = pkgs.zsh;
-    users."${user}" = {
-      isNormalUser = true;
-      #      hashedPasswordFile = password;
-      password = lib.mkForce "BogieDudie1";
-      extraGroups = [
-        "wheel"
-        "docker"
-      ];
-      openssh.authorizedKeys.keys = [
-        # macBook
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCw9zq8DLGByI5v2gAn95hKNyOsm3g61a2buxu2BBMFysQJgmZPCCLUqRJKhSM5Vm/JOgsAmdpRBRZQoHD+6S844CJHb4v4VIbjkyQgYCuM7Rst2IOZ5QybvsA2/D0nwytZ+HXQqDj2AagUYDbz0gyyIHkDQ5YGBMkvkWz/h1Vci6aoBM7VihEDM4KlWoTVuPeASGM8r5IZ2FS83Djbqo4ov6AYvLMrKB9Z7hmFgH6R3LE0gxOkzbGVXtSuvJyrjvgytoT22UhATjjxSQ9D+YJXXkQoB3lUdg8OoIquUPjMZpl4mR8ffvseWPfcvD1XlD5t+TOHFqKpESO547tlOBYhdpew+NSgAXpamCU6oyV8tDCywLQu2ucxHRn78u6WXzWHkDtffdhzmk6TZaPhWqVHuTGjR4higBgGqUfSaKOMszt+FDRZAr3HtuQ2+zJ8bowK9fW5OqilTtK2HtQqroD9ApegDNbqOz6kGy5IycSXvqPURy/M4lxZxbtBPuemcJs= mattjallen@MacBook-Pro.local"
-        # desktop windows
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ2PYPjZddOzR8OJj16G88KcUhCDLkvrEmpUQP0wKHDUuA27HQQ2ORo66asadwGHY3k1VDZ1ei9l9H++SIIeKOaaUr5yZdktvj4POUNtbd9ZhcS7sZU7BSF+NMDM+h3tImh6z0S7mWvRQOUv3ZM+ZER+5xTWJVG1OOJEpb1drxJk6Qz0wbZKSR7TPNFBLLXlVy7hkNYf07RtDyhCCxNB3hJfa8c+oztnWumwDhDQWLqiUXWIU2QH6iRLGl/WYnujtNvVVaV/Hn3JJkS6MM9dnV3cpoIO0+J7+WfsN9rZ0wXt5yY3GhiGXwmcO5eYVli8lHlLWtK7aYSETyry6CBsLbojzOQO5rSqhpwfF2njAAFAQU0UjLc8PahisIuFKCwHH4iyXXOagiv5K1Mc/0Ak+WhhMPee6vV2p7NTyNpXRvouDbWy5cSRH31WgQ9fK5mIGe5v8nGGqtEhUubUkiOgP+H3UbT2V/nTv/TFKdJcKw+WmizvTrxBmaMjWALlkYl+s= mattl@Jallen-PC"
-        # desktop nixos
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTBMydhOc6SnOdB5WrEd7X07DrboAtagCUgXiOJjLov matt@matt-nixos"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTha0FbV1tkpnJr7xVH78S5MetJH+0o2YrEcuvhL692 root@jallen-nas"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIwoHWOLSTGVif9hAhaMLl0qDA4roIzCNuyR6kyIXDOj admin@jallen-nas"
-      ];
-      shell = pkgs.zsh;
-    };
-    users.root.shell = pkgs.zsh;
-  };
 
   programs = {
     kdeconnect.enable = false;

systems/x86_64-linux/nas/boot.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   configLimit = 50;
   kernel = pkgs.linuxPackages; # linuxPackages_latest;

systems/x86_64-linux/nas/default.nix

@@ -109,6 +109,7 @@
     };
     user = {
       name = "admin";
+      linger = true;
     };
   };