emily
3cba4cbd86
Adds a new NixOS module (greg.monitoring-access) that provisions a dedicated, SSH-key-only 'emily' user account across all managed hosts. The account is intentionally minimal-privilege: - No password set (SSH key auth only) - Not a member of wheel, no sudo/sudo-rs rules - Only extra group membership is systemd-journal, granting read access to system logs for monitoring/analysis tasks - Authorized key lives in home/ssh/emily_authorized_keys, mirroring the existing pattern used for the greg account's authorized_keys This lets the Hermes agent (emily) log in read-only to inspect logs and system state when asked, without any ability to modify configuration, escalate privileges, or run destructive commands. Module is imported unconditionally in modules/nixos/default.nix like the other nixos modules, and defaults to enabled; it can be disabled per-host via greg.monitoring-access.enable = false if ever needed.
32 lines
459 B
Nix
32 lines
459 B
Nix
{
|
|
...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
./adblock-update.nix
|
|
./albyhub.nix
|
|
./backup.nix
|
|
./ceph.nix
|
|
./db.nix
|
|
./gitea-runner.nix
|
|
./gnome.nix
|
|
./home.nix
|
|
./kde.nix
|
|
#./kiwix-serve.nix
|
|
./kubernetes.nix
|
|
./linode.nix
|
|
./monitoring-access.nix
|
|
./podman.nix
|
|
./print.nix
|
|
./proxy.nix
|
|
./remote-builder.nix
|
|
./router.nix
|
|
./rpi4.nix
|
|
./syncthing.nix
|
|
./nebula.nix
|
|
./tailscale.nix
|
|
./vmdev.nix
|
|
];
|
|
}
|