emily
3cba4cbd86
Adds a new NixOS module (greg.monitoring-access) that provisions a dedicated, SSH-key-only 'emily' user account across all managed hosts. The account is intentionally minimal-privilege: - No password set (SSH key auth only) - Not a member of wheel, no sudo/sudo-rs rules - Only extra group membership is systemd-journal, granting read access to system logs for monitoring/analysis tasks - Authorized key lives in home/ssh/emily_authorized_keys, mirroring the existing pattern used for the greg account's authorized_keys This lets the Hermes agent (emily) log in read-only to inspect logs and system state when asked, without any ability to modify configuration, escalate privileges, or run destructive commands. Module is imported unconditionally in modules/nixos/default.nix like the other nixos modules, and defaults to enabled; it can be disabled per-host via greg.monitoring-access.enable = false if ever needed.
This is a unified repo to contain my personal configurations for NixOS machines.
How To Use This
Go through the normal process to setup a NixOS system during installation.
- Boot from an appropriate medium
- Parition the drives
- Mount them
- Before you generate out the configuration, clone this repoistory to your /etc/nixos folder
- Run the configuration generator. It should only genreate the hardware-configuration.nix file, which this repo gitignores
- Create a folder and file with the machine name in
hosts/<machine>/default.nix - Add
hosts/default.nixan appropriate entry for the machine you are building - Create a file
home/hosts/<machine>/default.nixwith the new machine name as well
Adding new hosts
To add a new host, create a folder in the directory hosts/ that matches the name of
the target system. Each host must contain, minimally, a default.nix file that serves
as the basis of configuring that host.
Test build a VM for your system
nom build ".#nixosConfigurations.<host>.config.system.build.vmexport QEMU_NET_OPTS="hostfwd=tcp::2221-:22"to export the SSH port./result/bin/run-<host>-vm