Skip to content

Commit 11e3a4f

Browse files
authored
Drop ssh as root and remotebuilder (#79)
2 parents 3bbad48 + 7d06339 commit 11e3a4f

1 file changed

Lines changed: 1 addition & 48 deletions

File tree

‎makemake/modules/users.nix‎

Lines changed: 1 addition & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{ lib, pkgs, ... }:
1+
{ lib, ... }:
22
let
33
# To give yourself permission to use `makemake` as a remote builder, add
44
# yourself to the list below (sorted appropriately). You'll need `remotebuild = true;`.
@@ -88,53 +88,6 @@ let
8888
};
8989
in
9090
{
91-
imports = [
92-
# TODO: remove this once everyone is using personal accounts:
93-
# <https://github.com/ngi-nix/infra/issues/26>.
94-
{
95-
users.users.root.openssh.authorizedKeys.keys = lib.pipe users [
96-
(lib.filterAttrs (name: user: user.wheel or false))
97-
(lib.mapAttrsToList (name: user: user.keys))
98-
lib.flatten
99-
];
100-
101-
users.users.remotebuild = {
102-
isNormalUser = true;
103-
createHome = false;
104-
group = "remotebuild";
105-
openssh.authorizedKeys.keys = lib.pipe users [
106-
(lib.filterAttrs (name: user: user.remotebuild or false))
107-
(lib.mapAttrsToList (name: user: user.keys))
108-
lib.flatten
109-
];
110-
};
111-
112-
systemd.tmpfiles.rules =
113-
let
114-
rootBashProfile = pkgs.writeText "bash_profile" /* bash */ ''
115-
if [ -n "$SSH_CONNECTION" ]; then
116-
echo "" >&2
117-
echo "*** NOTE: SSH access as the root user is deprecated, and will be removed soon! ***" >&2
118-
echo "" >&2
119-
echo "Please switch to to your own personal user." >&2
120-
echo "See <https://github.com/ngi-nix/infra/issues/37> for details." >&2
121-
fi
122-
'';
123-
remoteBuildBashProfile = pkgs.writeText "bash_profile" /* bash */ ''
124-
echo "" >&2
125-
echo "*** NOTE: The remotebuild user is deprecated, and will be removed soon! ***" >&2
126-
echo "" >&2
127-
echo "Please switch to to your own personal user." >&2
128-
echo "See <https://github.com/ngi-nix/infra/issues/37> for details." >&2
129-
'';
130-
in
131-
[
132-
"L+ /root/.bash_profile 0644 root root - ${rootBashProfile}"
133-
"L+ /home/remotebuild/.bash_profile 0644 remotebuild remotebuild - ${remoteBuildBashProfile}"
134-
];
135-
}
136-
];
137-
13891
nix.settings.trusted-users = [
13992
# This allows using `makemake` as a remote builder.
14093
"@remotebuild"

0 commit comments

Comments
 (0)