From 05948d31c27f4a3b8e08c96604089ce9464b496e Mon Sep 17 00:00:00 2001
From: Jurn Wubben <jsw@jsw.tf>
Date: Tue, 23 Sep 2025 08:10:26 +0000
Subject: [PATCH] Updated secrets

---
 secrets/derek-bot.age       | Bin 1124 -> 1124 bytes
 system/server/derek-bot.nix |  27 ++++++++++++++++++++++++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/secrets/derek-bot.age b/secrets/derek-bot.age
index f45ac469bf36dc83ed10f2a869114b6d3da43dfb..6d1a80cad3d3d70f97eafbbcfb4b28f8d91b08a4 100644
GIT binary patch
delta 1038
zcmaFD@q}Z7PJKyoQc=01zo$X2uUSP>gnm$Ng@0~Zai&>tfT>HQlVxh5X-=X^q=$QE
zIag#<rDsNXkwLIWNm!9-g;QaUQ$b~JvVLW1NnuWQSa_m#rK5JZfq#mx0hg|wLUD11
zZfc5=si~o*f^S-od6=VubGCnQN};#5Yq?92M`clxuUn>Pa9&nXa)gI=u6JpAVwHAc
zdS;NDbB<9umwSjuT4|P-cDZ4(c~GENW`tv5MS)>~Q=o6LZ&;AIky(<yS#gC|h;~)v
z#E;_PDZx&WId0x1VI_u{o}pQVZbngF&VGqrnaQahDanSO`j(;I0T!7)E{6GBrA1Ep
zVVOBznJHC?rg{1)xupjFZpo(EnZ@ZwDejKO&f!r3h1ofNp8naB;~B-nLxWr*OY*Xl
zL&`E-OcM<q3ll@KOv?2OT_Pj2EiBxe6EhsOBfS#6gEG>&ER6NDoRWOKqk@x-A`85O
z%rkP6Q`~&rlJ(t!(sD}+qOzh2Qq0n#{L4%xpJf!U_YDm)3Cwnm$o11VD#&njPV{$j
zPIcA}E4DPRDDd|-$}@9L4Yn*ZcP=;K(#{FX&9_Vr4vh4#GB!vF%L?#uH1G*Xt}HP%
zEqC`yEi5T;On3G$Fmp;rkAbkjN;88%1&^v^H>dm(e{TbmT#uZvf|PnUztXZ`-$+xh
zR5PD2|A3q%^WemCvs5$JNG_Lx5+mnGLl5^v6EAN^?aJi*FeBfbqL3(WbIYKr;vA#2
z@PeE?m*Vn>axPt6T?GrX0(TE1?GpVWKYf#Y_cVX^2>tA^A_Hx&fC?k80Jr3%lq4@7
z*H9l56E4$jPHQut>))xDQ+v1jTiN=BRn-<-u3Y#f_vy`3#@Vbk7dHqjS#tgB8advc
zFMD_M>aS2<J~iHXi%EcQflGI-(5s^!za#q_B%h_MH2meYdD)CUV^P=n#XdrF?DwR8
zE?aQHAkZgB+soRS=d)jgk=vt%42A&(jVzb?7AnS+{*;xDR|!wQYT%-GuAW&p^VCz3
zW5x&NnT}>UvpUbrShFhL<Z?>Jh3A)IHWv8E$u6q@RWBbdo|KvQvg?(v?3c&4nVy_n
z8F{hz?FXig@a`AW&fmE<opYYY#d{0(wX*G8asP9~f-{nz{>1K1UVbdE$f@bS+R+5|
zr+a_>tbX$7Qfxir>g+%A)pr(5kNhp+UY{6M@mFS{^l=?M(H!56YB2}nHg|ZnS8mZ<
zUbFkEq0)tqp=nOy*PMm)gzt8<oLRo5Y>vh=&Lwl$`j@Z2bKj^(=I|5&B?0!`)xP(7
zzp(SIZLHZP{5?A_Y4a`7%SSTT&DnP<`1_|jr+V)3PvO*h*LV8FGPmMQb{yG9w5qwz
O6qbEsO+7a!xe)+lQI@L!

delta 1038
zcmaFD@q}Z7PJODSSE^x<zgtdrd2(rBaI#xzYDH$1N2az#v9_CEN@!qIo@uVOshMZE
z1y^`LZlSMsKw55wr+boRWksfsdwPXYNN#?izlobgqCr-AdXQz2wxhn0374*&LUD11
zZfc5=si~o*f^S-od6=U@uv3z|L77XTftQbAs6m=rg<G&!uCIYfctlu;ONM!duaka3
zl$%9rl!?0qmtT^9YOteerhZtWxv@{FQ&D7AMQBk_zFBHXN>ZRjMnIXiOIlS{mcNV1
z#E;_P=IMcMsX1u|zLi0l6@~>)#(sgJmhReN&cPW$PHv&zIr`~lUS>(|K?dnuhULjs
zMt)}gF6FMC7A0OTnb|2`mii%K=H+F6zCn>$xnXHpF3F|tIZ4Tr;~B-n1KcWuE7CJl
z%tH-~oI^?jj0}B^eS$rMjkLpkz00yA%u3w6^Rz4S{WC4NLIcxNTp~Ry^2{vqOic<R
z@*^_53?f|IQk<QO3!MXeibGtpyfR(=4U!@!pJf!U4^Q?>N=%9hk8*TOwY1Dmi*Sla
zDl)Gs$}aH=&I>THFgA+{2yyo?ORX~D3ds*BOU}(J&WcJ*uS_c{GA+~hbG7sgO!INe
zaCJ$|EcK6YwJ^4fN=l7HkAbkjN;88%1(OH^eX|I612>Pdl+q%za<ls22p|8%!jLfY
zszMK=0?T~E;=rIF^P+6`a;|cHpY)WFB8xoN(y+=XQ^RzNq(aZ~<nr_o?Z5zEKZA^v
zs#O2v)U-T511?=%U4>K&52tifOa0QSY{QUjUvu}Iitvi6Z0|6a(lpa7rwFGU?ex&9
zfZV8%K(5VE&vKS{mbcbF_c+EsFTFXeb%o~USL+PamVEs`OP*=A<hk-+t^(f6B@)(c
z_wX~ZY)XI7r~E`#QTiFzZ`QJk>HlBOP2ujEZ1vsu?ZjQ(UC|Tv&f?$a9J0RR+#Y31
zo8KO0y#lflKMuvK#H>l#H1DWOtfi#%Ouh1;tP{GMw6A;r&NuKD3BKCKSYM*8s&D1^
zady;W(H-@Qzivn6er^}E$=|n$<(brRj@~0npDA^-GW1#UIErsBe7xCy(a%ta<zH@^
zi!ryqSe{tP)1u*|{^sJnt|LFTS_Wl!sH&}2OE3IT^nCU=<$KGDoIf_SXz3QaT)HRY
z$t5dLqSB(dF(^ifTdQWp`PE$qcB|C0%@EpiQe%6VnhvAIg_|p{TAx=~<HWUo%Vw{i
zLD8F+S$uPB4VG^*&9zq6<DDlK5E-&K>>sm{2GeoJ8oP-pyIap2ytkM=XIW@e)a9w(
zQg=C-COi^pJ*LN2b=l^s61%p;<vYLn7`B$4U#L^z%jdULX_G9&N4A>|v!gcjPw&^?
L$$I`w<fe82O=E;x

diff --git a/system/server/derek-bot.nix b/system/server/derek-bot.nix
index ec9df16..4372258 100644
--- a/system/server/derek-bot.nix
+++ b/system/server/derek-bot.nix
@@ -76,7 +76,32 @@ in {
     users.groups.${userGroup} = {};
     users.users.${userGroup} = {
       group = userGroup;
-      isSystemUser = true;
+      isNormalUser = true;
+      home = "/home/${userGroup}";
     };
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+	if (action.id == "org.freedesktop.systemd1.manage-units" &&
+	  action.lookup("unit") == "${userGroup}.service" &&
+	  subject.user == "${userGroup}") {
+	  return polkit.Result.YES;
+	}
+      });
+      polkit.addRule(function(action, subject) {
+	  if (
+	      subject.user == "${userGroup}" &&
+	      (
+		action.id == "org.freedesktop.login1.power-off" ||
+		action.id == "org.freedesktop.login1.power-off-ignore-inhibit" ||
+		action.id == "org.freedesktop.login1.power-off-multiple-sessions" ||
+		action.id == "org.freedesktop.login1.reboot" ||
+		action.id == "org.freedesktop.login1.reboot-ignore-inhibit" ||
+		action.id == "org.freedesktop.login1.reboot-multiple-sessions"
+	      )
+	  ) {
+	      return polkit.Result.NO;
+	  }
+      });
+    '';
   };
 }