greyweather
9a3530aa6a
- iptables geoip whitelist for ssh - NOPASSWD for efibootmgr, allowing easy reboot into windows from laptop/phone - no fastfetch for remote shells
52 lines
1.2 KiB
Nix
52 lines
1.2 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
...
|
|
}: {
|
|
security.sudo = {
|
|
enable = true;
|
|
extraRules = [{
|
|
commands = [
|
|
{
|
|
command = "${pkgs.systemd}/bin/systemctl poweroff";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${pkgs.systemd}/bin/shutdown";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${pkgs.systemd}/bin/systemctl reboot";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${pkgs.systemd}/bin/reboot";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${pkgs.efibootmgr}/bin/efibootmgr";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/efibootmgr";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${pkgs.efibootmgr}/bin/efibootdump";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "${pkgs.efibootmgr}/sbin/efibootdump";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
users = [ "grey" ];
|
|
}];
|
|
extraConfig = with pkgs; ''
|
|
Defaults:grey secure_path="${lib.makeBinPath [
|
|
systemd
|
|
]}:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"
|
|
'';
|
|
};
|
|
}
|