Merge pull request 'emergency-access: init service' (#3950) from emergency-access into main

Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/3950
Reviewed-by: pinpox <clan@pablo.tools>

clanServices/admin/default.nix

@@ -26,7 +26,6 @@
         nixosModule =
           { ... }:
           {
-
             imports = [
               ../../clanModules/sshd
               ../../clanModules/root-password

clanServices/emergency-access/README.md

@@ -0,0 +1,16 @@
+This service will automatically set the emergency access password if your system fails to boot.
+
+## Usage
+
+```nix
+inventory.instances = {
+  mylounge = {
+    module = {
+      name = "emergency-access";
+      input = "clan-core";
+    };
+
+    roles.default.tags.nixos = { };
+  };
+}
+```

clanServices/emergency-access/default.nix

@@ -0,0 +1,31 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "clan-core/emergency-access";
+  manifest.description = "Set recovery password for emergency access to machine";
+  manifest.categories = [ "System" ];
+
+  roles.default.perInstance = {
+    nixosModule =
+      { config, pkgs, ... }:
+      {
+        boot.initrd.systemd.emergencyAccess =
+          config.clan.core.vars.generators.emergency-access.files.password-hash.value;
+
+        clan.core.vars.generators.emergency-access = {
+          runtimeInputs = [
+            pkgs.coreutils
+            pkgs.mkpasswd
+            pkgs.xkcdpass
+          ];
+          files.password.secret = true;
+          files.password-hash.secret = false;
+
+          script = ''
+            xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > $out/password
+            mkpasswd -s -m sha-512 < $out/password | tr -d "\n" > $out/password-hash
+          '';
+        };
+      };
+  };
+}

clanServices/emergency-access/flake-module.nix

@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  clan.modules = {
+    emergency-access = lib.modules.importApply ./default.nix { };
+  };
+}

docs/mkdocs.yml

@@ -86,6 +86,7 @@ nav:
           - reference/clanServices/auto-upgrade.md
           - reference/clanServices/borgbackup.md
           - reference/clanServices/deltachat.md
+          - reference/clanServices/emergency-access.md
           - reference/clanServices/ergochat.md
           - reference/clanServices/garage.md
           - reference/clanServices/heisenbridge.md