From a2bd672cf7c6277ce99c874d00f4e9a35a362404 Mon Sep 17 00:00:00 2001
From: luochen570 <1160510664@qq.com>
Date: Wed, 27 May 2026 06:47:50 +0800
Subject: [PATCH] refactor: move sudo to core, lxc SSH to profile, clean up old
 lxc config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- sudo (wheelNeedsPassword) → modules/core/core.nix (全局)
- LXC SSH override (PermitRootLogin, PasswordAuth) → profiles/lxc.nix
- modules/server/ssh.nix: use mkDefault so profiles can override
- Delete modules/optional/lxc.nix
- Clean up hosts/nixos-lxc/configuration.nix: remove redundant SSH/sudo/users
  (now handled by core + server + profile chain)
- Update modules/optional/README.md
---
 hosts/nixos-lxc/configuration.nix | 22 ----------------------
 modules/core/core.nix             |  3 +++
 modules/server/ssh.nix            | 11 +++++------
 profiles/lxc.nix                  |  8 ++++++++
 4 files changed, 16 insertions(+), 28 deletions(-)

diff --git a/hosts/nixos-lxc/configuration.nix b/hosts/nixos-lxc/configuration.nix
index e1d48fc..700f2e5 100644
--- a/hosts/nixos-lxc/configuration.nix
+++ b/hosts/nixos-lxc/configuration.nix
@@ -21,32 +21,10 @@
   # 由宿主机处理 fstrim
   services.fstrim.enable = false;
 
-  services.openssh = {
-    enable = true;
-    openFirewall = true;
-    settings = {
-      PermitRootLogin = "yes";
-      PasswordAuthentication = true;
-    };
-  };
-
-  # 用户账户配置
-  users.users.luochen570 = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "networkmanager" ];
-  };
-
-  security.sudo.wheelNeedsPassword = false;
-
   services.resolved = {
     extraConfig = ''
       Cache=true
       CacheFromLocalhost=true
     '';
   };
-
-  nix.settings.substituters = [ "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store" ];
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-
-  system.stateVersion = "25.05";
 }
diff --git a/modules/core/core.nix b/modules/core/core.nix
index d7b4057..008d484 100644
--- a/modules/core/core.nix
+++ b/modules/core/core.nix
@@ -24,4 +24,7 @@
   time.timeZone = lib.mkDefault "Asia/Shanghai";
   i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
 
+  # 允许 wheel 组免密 sudo
+  security.sudo.wheelNeedsPassword = false;
+
 }
diff --git a/modules/server/ssh.nix b/modules/server/ssh.nix
index fbb3583..60f8fb5 100644
--- a/modules/server/ssh.nix
+++ b/modules/server/ssh.nix
@@ -1,14 +1,13 @@
-{ ... }:
+{ lib, ... }:
 {
   services.openssh = {
     enable = true;
     openFirewall = true;
     settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-      PermitRootLogin = "no";
-      X11Forwarding = false;
+      PasswordAuthentication = lib.mkDefault false;
+      KbdInteractiveAuthentication = lib.mkDefault false;
+      PermitRootLogin = lib.mkDefault "no";
+      X11Forwarding = lib.mkDefault false;
     };
   };
 }
-
diff --git a/profiles/lxc.nix b/profiles/lxc.nix
index 707fc3c..f7d91fb 100644
--- a/profiles/lxc.nix
+++ b/profiles/lxc.nix
@@ -2,5 +2,13 @@
 {
   imports = [
     ../modules/core
+    ../modules/server
   ];
+
+  # LXC 容器需要密码登录（s0.sermc.net，无 SSH key 注入）
+  services.openssh.settings = {
+    PermitRootLogin = "prohibit-password";
+    PasswordAuthentication = true;
+    KbdInteractiveAuthentication = true;
+  };
 }