Ghaf user accounts

flake.nix

@@ -140,7 +140,7 @@
     };
 
     impermanence = {
-      url = "github:nix-community/impermanence";
+      url = "github:nix-community/impermanence/32b1094d28d5fbedcc85a403bc08c8877b396255";
     };
 
     givc = {

modules/common/default.nix

@@ -11,7 +11,7 @@
     ./firewall
     ./profiles
     ./security
-    ./users/accounts.nix
+    ./users
     ./version
     ./virtualization/docker.nix
     ./systemd

modules/common/profiles/debug.nix

@@ -15,7 +15,6 @@ in
   config = lib.mkIf cfg.enable {
     # Enable default accounts and passwords
     ghaf = {
-      users.accounts.enable = true;
       # Enable development on target
       development = {
         nix-setup.enable = true;

modules/common/profiles/release.nix

@@ -18,6 +18,6 @@ in
     # TODO this needs to be refined when we define a policy for the
     # processes and the UID/groups that should be enabled by default
     # if not already covered by systemd
-    ghaf.users.accounts.enable = true;
+    # ghaf.users.admin.enable = true;
   };
 }

modules/common/services/audio.nix

@@ -81,13 +81,6 @@ in
       };
     };
 
-    # Allow ghaf user to access pulseaudio and pipewire
-    users.extraUsers.ghaf.extraGroups = [
-      "audio"
-      "video"
-      "pipewire"
-    ];
-
     # Start pipewire on system boot
     systemd.services.pipewire.wantedBy = [ "multi-user.target" ];
 

modules/common/services/fprint.nix

@@ -46,38 +46,19 @@ in
           // Allow user to verify fingerprints
           polkit.addRule(function(action, subject) {
           if (action.id == "net.reactivated.fprint.device.verify" &&
-              subject.user == "ghaf") {
+              subject.isInGroup ("users")) {
             return polkit.Result.YES;
             }
           });
           // Allow user to enroll fingerprints
           polkit.addRule(function(action, subject) {
           if (action.id == "net.reactivated.fprint.device.enroll" &&
-              subject.user == "ghaf") {
+              subject.isInGroup ("users")) {
             return polkit.Result.YES;
             }
           });
         '';
       };
-      # PAM rules for swaylock fingerprint reader
-      pam.services = {
-        swaylock.text = ''
-          # Account management.
-          account required pam_unix.so
-
-          # Authentication management.
-          auth sufficient pam_unix.so likeauth try_first_pass
-          auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
-          auth required pam_deny.so
-
-          # Password management.
-          password sufficient pam_unix.so nullok sha512
-
-          # Session management.
-          session required pam_env.so conffile=/etc/pam/environment readenv=0
-          session required pam_unix.so
-        '';
-      };
     };
   };
 }

modules/common/services/xdgopener.nix

@@ -22,6 +22,7 @@ let
   # into all targets
   ghaf-xdg-open = pkgs.callPackage ../../../packages/ghaf-xdg-open {
     inherit (config.ghaf.security.sshKeys) sshKeyPath;
+    user = config.ghaf.users.appUser.name;
   };
 in
 {
@@ -51,9 +52,6 @@ in
       services."xdg@" = {
         description = "XDG opener";
         serviceConfig = {
-          # The user 'ghaf' is used here to access SSH keys for the scp command
-          # This is required to copy files to the zathuravm
-          User = "ghaf";
           ExecStart = "${ghaf-xdg-open}/bin/ghaf-xdg-open";
           StandardInput = "socket";
           StandardOutput = "journal";

modules/common/systemd/base.nix

@@ -16,6 +16,7 @@ let
     mkIf
     mkForce
     types
+    optionalAttrs
     ;
 
   # Override minimal systemd package configuration
@@ -29,10 +30,11 @@ let
         inherit (cfg) withAudit;
         withCompression = true;
         withCoredump = cfg.withDebug || cfg.withMachines;
-        inherit (cfg) withCryptsetup;
+        withCryptsetup = cfg.withCryptsetup || cfg.withHomed;
         inherit (cfg) withEfi;
         inherit (cfg) withBootloader;
         inherit (cfg) withFido2;
+        inherit (cfg) withHomed;
         inherit (cfg) withHostnamed;
         withImportd = cfg.withMachines;
         withKexectools = cfg.withDebug;
@@ -54,6 +56,7 @@ let
         inherit (cfg) withTimesyncd;
         inherit (cfg) withTpm2Tss;
         inherit (cfg) withUkify;
+        withUserDb = cfg.withHomed;
         withUtmp = cfg.withJournal || cfg.withAudit;
       }
       // lib.optionalAttrs (lib.strings.versionAtLeast pkgs.systemdMinimal.version "255.0") {
@@ -150,6 +153,12 @@ let
       "systemd-networkd.service"
       "systemd-networkd.socket"
     ])
+    ++ (lib.optionals (!cfg.withAudio) [
+      "sound.target"
+    ])
+    ++ (lib.optionals (!cfg.withBluetooth) [
+      "bluetooth.target"
+    ])
     ++ (lib.optionals (!cfg.withDebug) [
       ## Units kept with debug
       "kbrequest.target"
@@ -223,6 +232,12 @@ in
       default = false;
     };
 
+    withHomed = mkOption {
+      description = "Enable systemd homed for users home functionality.";
+      type = types.bool;
+      default = false;
+    };
+
     withHostnamed = mkOption {
       description = "Enable systemd hostname daemon.";
       type = types.bool;
@@ -307,11 +322,29 @@ in
       default = false;
     };
 
+    withAudio = mkOption {
+      description = "Enable audio functionality.";
+      type = types.bool;
+      default = false;
+    };
+
+    withBluetooth = mkOption {
+      description = "Enable bluetooth functionality.";
+      type = types.bool;
+      default = false;
+    };
+
     withDebug = mkOption {
       description = "Enable systemd debug functionality.";
       type = types.bool;
       default = false;
     };
+
+    verboseLogs = mkOption {
+      description = "Increase systemd log verbosity.";
+      type = types.bool;
+      default = false;
+    };
   };
 
   config = mkIf cfg.enable {
@@ -324,6 +357,9 @@ in
       # Misc. configurations
       enableEmergencyMode = cfg.withDebug;
       coredump.enable = cfg.withDebug || cfg.withMachines;
+      managerEnvironment = optionalAttrs cfg.verboseLogs {
+        SYSTEMD_LOG_LEVEL = "debug";
+      };
 
       # Service startup optimization
       services.systemd-networkd-wait-online.enable = mkForce false;

modules/common/systemd/boot.nix

@@ -11,7 +11,12 @@ let
   cfg = config.ghaf.systemd.boot;
   cfgBase = config.ghaf.systemd;
 
-  inherit (lib) mkEnableOption mkIf optionals;
+  inherit (lib)
+    mkIf
+    optionals
+    mkOption
+    optionalAttrs
+    ;
 
   # Package configuration
   package = pkgs.systemdMinimal.override (
@@ -33,8 +38,7 @@ let
 
   # Suppressed initrd systemd units
   suppressedUnits =
-    [ "multi-user.target" ]
-    ++ (lib.optionals ((!cfgBase.withDebug) && (!cfgBase.withJournal)) [
+    (lib.optionals ((!cfgBase.withDebug) && (!cfgBase.withJournal)) [
       "systemd-journald.service"
       "systemd-journald.socket"
       "systemd-journald-dev-log.socket"
@@ -54,23 +58,29 @@ let
 in
 {
   options.ghaf.systemd.boot = {
-    enable = mkEnableOption "Enable systemd in stage 1 of the boot (initrd).";
+    enable = mkOption {
+      default = config.ghaf.systemd.enable;
+      description = "Enable systemd in stage 1 of the boot (initrd).";
+    };
   };
 
   config = mkIf cfg.enable {
     boot.initrd = {
-      verbose = config.ghaf.profiles.debug.enable;
+      verbose = cfgBase.verboseLogs;
       services.lvm.enable = true;
       systemd = {
         enable = true;
         inherit package;
         inherit suppressedUnits;
-        emergencyAccess = config.ghaf.profiles.debug.enable;
+        emergencyAccess = cfgBase.withDebug;
         tpm2.enable = cfgBase.withTpm2Tss;
-        initrdBin = optionals config.ghaf.profiles.debug.enable [
+        initrdBin = optionals cfgBase.withDebug [
           pkgs.lvm2
           pkgs.util-linux
         ];
+        managerEnvironment = optionalAttrs cfgBase.verboseLogs {
+          SYSTEMD_LOG_LEVEL = "debug";
+        };
       };
     };
   };