blob: 70d6669ca3755e5fcd8a0c8c15b28aac4b59b162 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
{ config, lib, ... }:
let
magician = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII42yGEm1u3FxKdgox6Kkp9IBgBERVKrcIjQkrVbEO3m alex@kassouni.net";
hierophant = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqok+IgFuByRuoKM8HbiM919QmAVFvB2rI7ewgGsCiJ kassouni@hierophant";
in
{
options.my = {
adminKeys = lib.mkOption {
type = with lib.types; listOf singleLineStr;
description = ''
Keys granted an interactive shell in the wheel group, i.e. root by way
of sudo. Only add a key you would trust with the whole machine.
'';
};
gitKeys = lib.mkOption {
type = with lib.types; listOf singleLineStr;
description = ''
Keys granted git-shell access to the repositories under /srv/git.
No interactive shell and no sudo, so this is the list to grow when
someone needs to push.
'';
};
};
config.my = {
adminKeys = [
hierophant
magician
];
# Admins push too; collaborator keys belong here and nowhere else.
gitKeys = config.my.adminKeys;
};
}
|
