From e037e164c5c45ff33525d0c8575e8d9e0315ac7b Mon Sep 17 00:00:00 2001
From: Alexander Kassouni <alex@kassouni.net>
Date: Sun, 27 Sep 2026 22:07:56 -0700
Subject: move nix modules

---
 nix/options.nix | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 nix/options.nix

(limited to 'nix/options.nix')

diff --git a/nix/options.nix b/nix/options.nix
new file mode 100644
index 0000000..faaf2c8
--- /dev/null
+++ b/nix/options.nix
@@ -0,0 +1,33 @@
+{config, lib, ...}: let
+  magician = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII42yGEm1u3FxKdgox6Kkp9IBgBERVKrcIjQkrVbEO3m alex@kassouni.net";
+  hierophant = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqok+IgFuByRuoKM8HbiM919QmAVFvB2rI7ewgGsCiJ kassouni@hierophant";
+in {
+  options.my = {
+    adminKeys = lib.mkOption {
+      type = with lib.types; listOf singleLineStr;
+      description = ''
+        Keys granted an interactive shell in the wheel group, i.e. root by way
+        of sudo. Only add a key you would trust with the whole machine.
+      '';
+    };
+
+    gitKeys = lib.mkOption {
+      type = with lib.types; listOf singleLineStr;
+      description = ''
+        Keys granted git-shell access to the repositories under /srv/git.
+        No interactive shell and no sudo, so this is the list to grow when
+        someone needs to push.
+      '';
+    };
+  };
+
+  config.my = {
+    adminKeys = [ 
+      hierophant 
+      magician 
+    ];
+
+    # Admins push too; collaborator keys belong here and nowhere else.
+    gitKeys = config.my.adminKeys;
+  };
+}
-- 
cgit v1.3.1