mirror of
https://github.com/RGBCube/ncc
synced 2026-01-20 20:21:07 +00:00
RGBCube
62c575774b
- No more fail2ban. It didn't work properly anyways, I'll need to look into this in the future - No nix-super. I don't need it and the overlay is broken so I'm waiting for that to be fixed first. - Uses nh instead of nixos-rebuild. This is much better.
68 lines
1.7 KiB
Nix
68 lines
1.7 KiB
Nix
{ lib, ... }: with lib; merge
|
|
|
|
(desktopSystemConfiguration {
|
|
security.sudo.wheelNeedsPassword = false;
|
|
})
|
|
|
|
(systemConfiguration {
|
|
security.sudo = enabled {
|
|
execWheelOnly = true;
|
|
extraConfig = ''
|
|
Defaults lecture = never
|
|
Defaults pwfeedback
|
|
Defaults env_keep += "DISPLAY EDITOR PATH"
|
|
${optionalString isServer ''
|
|
Defaults timestamp_timeout = 0
|
|
''}
|
|
'';
|
|
|
|
extraRules = [{
|
|
groups = [ "wheel" ];
|
|
commands = let
|
|
system = "/run/current-system";
|
|
store = "/nix/store";
|
|
in [
|
|
{
|
|
command = "${store}/*/bin/switch-to-configuration";
|
|
options = [ "SETENV" "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nix system activate";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nix system apply";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nix system boot";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nix system build";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nix-collect-garbage";
|
|
options = [ "SETENV" "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nix-env";
|
|
options = [ "SETENV" "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nix-store";
|
|
options = [ "SETENV" "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/nixos-rebuild";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${system}/sw/bin/systemctl";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}];
|
|
};
|
|
})
|