yadunut/clan-core
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

rework root-password module

Browse Source
This commit is contained in:
Jörg Thalheim
2024-04-12 13:37:33 +02:00
committed by Mic92
parent b535768568
commit c8dd4bbfd6
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
clanModules/root-password.nix
View File

@@ -1,11 +1,12 @@
{ pkgs, config, ... }: { pkgs, config, ... }:
{ {
users.mutableUsers = false; users.mutableUsers = false;
users.extraUsers.root.hashedPasswordFile = "/run/secrets-for-users/passwordHash"; users.users.root.hashedPasswordFile =
sops.secrets."${config.clanCore.machineName}-passwordHash".neededForUsers = true; config.clanCore.facts.services.root-password.secret.password-hash.path;
clanCore.facts.services.password = { sops.secrets."${config.clanCore.machineName}-password-hash".neededForUsers = true;
clanCore.facts.services.root-password = {
secret.password = { }; secret.password = { };
secret.passwordHash = { }; secret.password-hash = { };
generator.path = with pkgs; [ generator.path = with pkgs; [
coreutils coreutils
xkcdpass xkcdpass
@@ -13,7 +14,7 @@
]; ];
generator.script = '' generator.script = ''
xkcdpass --numwords 3 --delimiter - --count 1 > $secrets/password xkcdpass --numwords 3 --delimiter - --count 1 > $secrets/password
cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/password-hash
''; '';
}; };
} }