Adds a new greg.monitoring-access NixOS module that provisions a dedicated, minimal-privilege emily account across all managed hosts, so I (the Hermes agent) can log in for monitoring/log-analysis tasks when you ask me to.
Access model (read-only by design)
SSH-key-only login — no password is set on the account
Not added to wheel; no sudo/sudo-rs rules granted
Only extra group membership is systemd-journal, which grants read access to system logs (journalctl) — sufficient for health checks and log analysis, nothing more
Public key lives in home/ssh/emily_authorized_keys, mirroring the existing pattern for greg's authorized_keys
New module is imported like every other module in modules/nixos/default.nix and defaults to enable = true, with a greg.monitoring-access.enable = false escape hatch per-host if you ever want to exclude a specific box
Why
So I can do monitoring/analysis on the homelab systems on request without needing your credentials or elevated access.
Testing
No local Nix toolchain available in my sandbox to run a full nix flake check / build, so this hasn't been evaluated against the flake. I checked the module against existing sibling modules (tailscale.nix, backup.nix, etc.) for idiom/style consistency (with lib;, mkOption/mkIf patterns, age.secrets-free since no secrets are needed here). Please review before merging, and let me know if you'd like CI/garnix to run against this branch first.
## What
Adds a new `greg.monitoring-access` NixOS module that provisions a dedicated, minimal-privilege `emily` account across all managed hosts, so I (the Hermes agent) can log in for monitoring/log-analysis tasks when you ask me to.
## Access model (read-only by design)
- SSH-key-only login — no password is set on the account
- **Not** added to `wheel`; no `sudo`/`sudo-rs` rules granted
- Only extra group membership is `systemd-journal`, which grants read access to system logs (`journalctl`) — sufficient for health checks and log analysis, nothing more
- Public key lives in `home/ssh/emily_authorized_keys`, mirroring the existing pattern for `greg`'s `authorized_keys`
- New module is imported like every other module in `modules/nixos/default.nix` and defaults to `enable = true`, with a `greg.monitoring-access.enable = false` escape hatch per-host if you ever want to exclude a specific box
## Why
So I can do monitoring/analysis on the homelab systems on request without needing your credentials or elevated access.
## Testing
No local Nix toolchain available in my sandbox to run a full `nix flake check` / build, so this hasn't been evaluated against the flake. I checked the module against existing sibling modules (`tailscale.nix`, `backup.nix`, etc.) for idiom/style consistency (`with lib;`, `mkOption`/`mkIf` patterns, `age.secrets`-free since no secrets are needed here). Please review before merging, and let me know if you'd like CI/garnix to run against this branch first.
Adds a new NixOS module (greg.monitoring-access) that provisions a
dedicated, SSH-key-only 'emily' user account across all managed hosts.
The account is intentionally minimal-privilege:
- No password set (SSH key auth only)
- Not a member of wheel, no sudo/sudo-rs rules
- Only extra group membership is systemd-journal, granting read access
to system logs for monitoring/analysis tasks
- Authorized key lives in home/ssh/emily_authorized_keys, mirroring the
existing pattern used for the greg account's authorized_keys
This lets the Hermes agent (emily) log in read-only to inspect logs and
system state when asked, without any ability to modify configuration,
escalate privileges, or run destructive commands.
Module is imported unconditionally in modules/nixos/default.nix like
the other nixos modules, and defaults to enabled; it can be disabled
per-host via greg.monitoring-access.enable = false if ever needed.
greg
merged commit 3995eee7b0 into main2026-08-09 19:54:46 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
Adds a new
greg.monitoring-accessNixOS module that provisions a dedicated, minimal-privilegeemilyaccount across all managed hosts, so I (the Hermes agent) can log in for monitoring/log-analysis tasks when you ask me to.Access model (read-only by design)
wheel; nosudo/sudo-rsrules grantedsystemd-journal, which grants read access to system logs (journalctl) — sufficient for health checks and log analysis, nothing morehome/ssh/emily_authorized_keys, mirroring the existing pattern forgreg'sauthorized_keysmodules/nixos/default.nixand defaults toenable = true, with agreg.monitoring-access.enable = falseescape hatch per-host if you ever want to exclude a specific boxWhy
So I can do monitoring/analysis on the homelab systems on request without needing your credentials or elevated access.
Testing
No local Nix toolchain available in my sandbox to run a full
nix flake check/ build, so this hasn't been evaluated against the flake. I checked the module against existing sibling modules (tailscale.nix,backup.nix, etc.) for idiom/style consistency (with lib;,mkOption/mkIfpatterns,age.secrets-free since no secrets are needed here). Please review before merging, and let me know if you'd like CI/garnix to run against this branch first.