modules: reorganize standalone and system user handling

2 files changed, 52 insertions, 0 deletions

diff --git a/modules/nixos/base/default.nix b/modules/nixos/base/default.nix
index 31cd6ff..421f733 100644
--- a/modules/nixos/base/default.nix
+++ b/modules/nixos/base/default.nix
@@ -11,6 +11,7 @@
     ./nix.nix
     ./programs.nix
     ./security.nix
+    ./users.nix
   ];
 
   services.journald.extraConfig = ''
diff --git a/modules/nixos/base/users.nix b/modules/nixos/base/users.nix
new file mode 100644
index 0000000..8a554f5
--- /dev/null
+++ b/modules/nixos/base/users.nix
@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  pkgs,
+  secretsDir,
+  ...
+}: let
+  cfg = config.base.users;
+in {
+  options.base.users = {
+    enable = lib.mkEnableOption "base user configurations" // {default = true;};
+
+    defaultRoot = {
+      enable = lib.mkEnableOption "default root user configuration" // {default = true;};
+      manageSecrets =
+        lib.mkEnableOption "automatic secrets management"
+        // {
+          default = config.traits.secrets.enable;
+        };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        users = {
+          defaultUserShell = pkgs.bash;
+          mutableUsers = false;
+        };
+      }
+
+      (lib.mkIf cfg.defaultRoot.enable {
+        users.users.root = {
+          home = lib.mkDefault "/root";
+          uid = lib.mkDefault config.ids.uids.root;
+          group = lib.mkDefault "root";
+        };
+      })
+
+      (lib.mkIf cfg.defaultRoot.manageSecrets {
+        age.secrets = {
+          rootPassword.file = secretsDir + "/rootPassword.age";
+        };
+
+        users.users.root = {
+          hashedPasswordFile = config.age.secrets.rootPassword.path;
+        };
+      })
+    ]
+  );
+}