jsw/NiksOS
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: jsw:3e07bd2b225dc971eb99d3f1c6d03afdd621e197
Branches Tags
jsw:master
jsw:derek-site
...
compare: jsw:a0638fdff32b8013ed72155693edfd87fadd66bb
Branches Tags
jsw:derek-site
jsw:master

2 commits
3e07bd2b22 ... a0638fdff3

Author SHA1 Message Date
Jurn Wubben
a0638fdff3 Updated permissions 2025-09-30 16:49:52 +00:00
Jurn Wubben
05948d31c2 Updated secrets 2025-09-23 08:10:26 +00:00
2 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
secrets/derek-bot.age
View file

Binary file not shown.

32
system/server/derek-bot.nix
View file

@ -76,7 +76,37 @@ in {
users.groups.${userGroup} = {}; users.groups.${userGroup} = {};
users.users.${userGroup} = { users.users.${userGroup} = {
group = userGroup; group = userGroup;
isSystemUser = true; isNormalUser = true;
home = "/home/${userGroup}";
}; };
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
polkit.log("Rule triggered. Action: " + action.id + " Unit: " + action.lookup("unit") + " User: " + subject.user);
// For journalctl access
if ((action.id == "org.freedesktop.systemd1.manage-units" ||
action.id == "org.freedesktop.systemd1.unit-journal") &&
action.lookup("unit") == "${userGroup}.service" &&
subject.user == "${userGroup}") {
polkit.log("ALLOWING access for " + subject.user);
return polkit.Result.YES;
}
});
polkit.addRule(function(action, subject) {
if (
subject.user == "${userGroup}" &&
(
action.id == "org.freedesktop.login1.power-off" ||
action.id == "org.freedesktop.login1.power-off-ignore-inhibit" ||
action.id == "org.freedesktop.login1.power-off-multiple-sessions" ||
action.id == "org.freedesktop.login1.reboot" ||
action.id == "org.freedesktop.login1.reboot-ignore-inhibit" ||
action.id == "org.freedesktop.login1.reboot-multiple-sessions"
)
) {
return polkit.Result.NO;
}
});
'';
}; };
} }