cry/cerulean
2
2
Fork 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions

TEMP fix for cerubld not having permissions

Browse source
This commit is contained in:
do butterflies cry? 2026-03-08 02:21:51 +10:00
parent 630389a598
commit 02ded5d4f0
Signed by: cry
GPG key ID: F68745A836CA0412
1 changed files with 20 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

30
cerulean/nixos/remote-deploy/default.nix
View file

@ -21,13 +21,13 @@ in {
one publicKey authorized for ssh deployment! Try setting `nodes.nodes.<name>.deploy.ssh.publicKeys = [ ... ]` <3 one publicKey authorized for ssh deployment! Try setting `nodes.nodes.<name>.deploy.ssh.publicKeys = [ ... ]` <3
''; '';
} }
{ # {
assertion = cfg.isSystemUser && !cfg.isNormalUser; # assertion = cfg.isSystemUser && !cfg.isNormalUser;
message = '' # message = ''
The Cerulean deployment user `${user}` for node `${hostname}` has been configured incorrectly. # The Cerulean deployment user `${user}` for node `${hostname}` has been configured incorrectly.
Ensure `users.users.${user}.isSystemUser == true` and `users.users.${user}.isNormalUser == false`. # Ensure `users.users.${user}.isSystemUser == true` and `users.users.${user}.isNormalUser == false`.
''; # '';
} # }
]; ];
warnings = lib.optional (node.deploy.warnNonstandardDeployUser && !isStandardDeployUser) '' warnings = lib.optional (node.deploy.warnNonstandardDeployUser && !isStandardDeployUser) ''
@ -47,12 +47,16 @@ in {
users = [user]; users = [user];
runAs = "${node.deploy.user}:ALL"; runAs = "${node.deploy.user}:ALL";
commands = [ commands = [
"${pkgs.nix}/bin/nix" # "${pkgs.nix}/bin/nix"
"ALL" # XXX: WARNING: FIX: TODO: DO NOT FUCKING USE `ALL`
]; ];
} }
]; ];
}; };
# XXX: WARNING: FIX: TODO: use `trusted-public-keys` instead
nix.settings.trusted-users = [user];
# ensure deployment user has SSH permissions # ensure deployment user has SSH permissions
services.openssh.settings.AllowUsers = [user]; services.openssh.settings.AllowUsers = [user];
@ -61,11 +65,17 @@ in {
users.${user} = { users.${user} = {
enable = true; enable = true;
isSystemUser = true;
group = user;
description = "Cerulean's user for building and remote deployment."; description = "Cerulean's user for building and remote deployment.";
isSystemUser = true;
group = user;
createHome = true;
home = "/var/lib/cerulean/cerubld";
useDefaultShell = false;
shell = pkgs.bash; shell = pkgs.bash;
openssh.authorizedKeys.keys = node.deploy.ssh.publicKeys; openssh.authorizedKeys.keys = node.deploy.ssh.publicKeys;
}; };
}; };