bascht
/
dotfiles
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Activity

[nix] Rework doas config to use proper rules instead of config + add Gulasch

This commit is contained in:
Sebastian Schulze 2021-11-01 17:25:07 +01:00
parent f24d923980
commit 53ce197917
Signed by: bascht
GPG Key ID: 5BCB1D3B4D38A35A
1 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
dot_config/nixos/configuration.nix
View File

@ -50,11 +50,32 @@
};
security.doas.enable = true;
security.doas.extraConfig = "permit nopass bascht as root cmd /run/current-system/sw/bin/openvpn";
security.doas.extraRules = [{
users = [ "bascht" ];
keepEnv = true;
persist = true;
users = [ "bascht" ];
keepEnv = true;
persist = true;
}{
users = [ "bascht" ];
keepEnv = true;
noPass = true;
cmd = "/run/current-system/sw/bin/openvpn";
}{
}{
users = [ "bascht" ];
keepEnv = true;
noPass = true;
cmd = "/run/current-system/sw/bin/cryptsetup";
}{
users = [ "bascht" ];
noPass = true;
cmd = "/run/current-system/sw/bin/cryptsetup";
args = ["luksOpen" "/dev/disk/by-partlabel/Gulasch" "Gulasch"];
}{
users = [ "bascht" ];
noPass = true;
cmd = "/run/wrappers/bin/mount";
args = ["/dev/mapper/Gulasch" "/mnt/Gulasch"];
}];
security.pam.loginLimits = [
{ domain = "@users"; item = "nofile"; type = "soft"; value = "4096"; }