Remove redundant sudo rules, use services.btrbk.sshAccess for more security

Changes

2 changed files (+18/-31)

• Unnamed-Server/default.nix
  • @@ -74,14 +74,9 @@
    # The best time zone time.timeZone = "UTC"; - users.users = { - a.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang" - ]; - btrbk.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoXy/V1rfnAcBJyRMAsqygOAeSNwxf8+oYtWNnUs3Rf btrbk@ThinkPad-X1-Yoga-Gen-6" - ]; - }; + users.users.a.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang" + ]; services.openssh = { enable = true; settings = {
  • @@ -213,8 +208,20 @@
    systemd.tmpfiles.rules = [ "L /var/cache/cgit - - - - /var/tmp" ]; # Back up / using btrfs snapshots and btrbk - services.btrbk.instances.btrbk = { - onCalendar = "daily"; - settings.volume."/".subvolume = "srv"; + services.btrbk = { + sshAccess = [ + { + key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoXy/V1rfnAcBJyRMAsqygOAeSNwxf8+oYtWNnUs3Rf btrbk@ThinkPad-X1-Yoga-Gen-6"; + roles = [ + "source" + "info" + "send" + ]; + } + ]; + instances.btrbk = { + onCalendar = "daily"; + settings.volume."/".subvolume = "srv"; + }; }; }
• configuration.nix
  • @@ -93,26 +93,6 @@
    snapshot_preserve_min = "latest"; }; }; - # Basically equivalent to making the btrbk user root? - security.sudo.extraRules = [ - { - users = [ "btrbk" ]; - commands = [ - { - command = "${pkgs.coreutils}/bin/test"; - options = [ "NOPASSWD" ]; - } - { - command = "${pkgs.coreutils}/bin/readlink"; - options = [ "NOPASSWD" ]; - } - { - command = "${pkgs.btrfs-progs}/bin/btrfs"; - options = [ "NOPASSWD" ]; - } - ]; - } - ]; # This option defines the first version of NixOS you have installed on this particular machine, # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.