luochen570
1be8b3d8e8
Temporary first-install shortcut kept as comment only; avoid plaintext password landing in /nix/store (world-readable).
23 lines
939 B
Nix
23 lines
939 B
Nix
{ lib, pkgs, username, config, ... }:
|
|
{
|
|
programs.zsh.enable = true;
|
|
users.defaultUserShell = pkgs.zsh;
|
|
|
|
users.users.${username} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "networkmanager" ];
|
|
shell = pkgs.zsh;
|
|
}
|
|
// lib.optionalAttrs (!(config.sops.secrets ? "users/luochen570/passwordHash")) {
|
|
# 安装新机时的临时密码快捷方式（明文仅用于首次安装，装完请改用 sops 哈希或移除）。
|
|
# 需要时解开注释使用；平时保持注释，避免明文进入 /nix/store。
|
|
# initialPassword = "Dly928730@..";
|
|
}
|
|
// lib.optionalAttrs (config.sops.secrets ? "users/luochen570/authorized_key") {
|
|
openssh.authorizedKeys.keyFiles = [ config.sops.secrets."users/luochen570/authorized_key".path ];
|
|
}
|
|
// lib.optionalAttrs (config.sops.secrets ? "users/luochen570/passwordHash") {
|
|
hashedPasswordFile = config.sops.secrets."users/luochen570/passwordHash".path;
|
|
};
|
|
}
|