make templates user-agnostic

Templates should not reference specific users. Users are added
manually when creating a new host from the template.

.forgejo/workflows/deploy.yml

@@ -29,7 +29,7 @@ jobs:
           mkdir -p ~/.ssh
           echo "$DEPLOY_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H cryodev.xyz >> ~/.ssh/known_hosts
+          ssh-keyscan -p 2299 -H cryodev.xyz >> ~/.ssh/known_hosts
 
       - name: Deploy with deploy-rs
         run: nix run github:serokell/deploy-rs -- -s .#cryodev-main

flake.nix

@@ -123,6 +123,10 @@
         nodes = {
           cryodev-main = {
             hostname = constants.domain;
+            sshOpts = [
+              "-p"
+              "2299"
+            ];
             profiles.system = {
               user = "root";
               path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.cryodev-main;

hosts/cryodev-main/services/openssh.nix

@@ -9,4 +9,9 @@
   ];
 
   services.openssh.enable = true;
+
+  # Root SSH key for deploy-rs (key-only, no password)
+  users.users.root.openssh.authorizedKeys.keyFiles = [
+    ../deploy-key.pub
+  ];
 }

hosts/cryodev-main/users.nix

@@ -4,5 +4,7 @@
   imports = [
     outputs.nixosModules.normalUsers
     ../../users/steffen
+    ../../users/ralph
+    ../../users/benjamin
   ];
 }

hosts/cryodev-pi/users.nix

@@ -4,6 +4,5 @@
   imports = [
     outputs.nixosModules.normalUsers
     ../../users/steffen
-    ../../users/cryotherm
   ];
 }

modules/nixos/openssh/default.nix

@@ -9,7 +9,7 @@ in
     ports = mkDefault [ 2299 ];
     openFirewall = mkDefault true;
     settings = {
-      PermitRootLogin = mkDefault "no";
+      PermitRootLogin = mkDefault "prohibit-password";
       PasswordAuthentication = mkDefault false;
     };
   };

templates/generic-server/users.nix

@@ -3,7 +3,7 @@
 {
   imports = [
     outputs.nixosModules.normalUsers
-    ../../users/steffen
-    ../../users/cryotherm
+    # Add users here, e.g.:
+    # ../../users/<username>
   ];
 }

templates/raspberry-pi/users.nix

@@ -3,7 +3,7 @@
 {
   imports = [
     outputs.nixosModules.normalUsers
-    ../../users/steffen
-    ../../users/cryotherm
+    # Add users here, e.g.:
+    # ../../users/<username>
   ];
 }

users/benjamin/default.nix

@@ -0,0 +1,11 @@
+{
+  normalUsers.benjamin = {
+    extraGroups = [
+      "wheel"
+    ];
+    sshKeyFiles = [
+      # TODO: Add benjamin's public key
+      # ./pubkeys/benjamin.pub
+    ];
+  };
+}

users/cryotherm/default.nix

@@ -1,7 +0,0 @@
-{
-  normalUsers.cryotherm = {
-    extraGroups = [ ];
-    # No sshKeyFiles, so password login only (if allowed) or local access
-    sshKeyFiles = [ ];
-  };
-}

users/ralph/default.nix

@@ -0,0 +1,11 @@
+{
+  normalUsers.ralph = {
+    extraGroups = [
+      "wheel"
+    ];
+    sshKeyFiles = [
+      # TODO: Add ralph's public key
+      # ./pubkeys/ralph.pub
+    ];
+  };
+}

users/steffen/default.nix

@@ -5,9 +5,6 @@
     extraGroups = [
       "wheel"
     ];
-    sshKeyFiles = [
-      ./pubkeys/X670E.pub
-      ./pubkeys/forgejo-deploy.pub
-    ];
+    sshKeyFiles = [ ./pubkeys/X670E.pub ];
   };
 }