refactor(hakurei): add kyuuto

systems/hakurei/lxc.json

@@ -1,6 +1,7 @@
 {
 	"lxc": {
 		"lxc.mount.entry": [
+			"/mnt/kyuuto-media mnt/kyuuto-media none bind,optional,create=dir",
 			"/dev/net/tun dev/net/tun none bind,optional,create=file"
 		],
 		"lxc.idmap": [

systems/hakurei/nixos.nix

@@ -17,6 +17,7 @@ in {
     nixos.sops
     nixos.base
     nixos.reisen-ct
+    nixos.kyuuto
     nixos.tailscale
     nixos.cloudflared
     nixos.ddclient
@@ -29,6 +30,7 @@ in {
     nixos.access.freeipa
     nixos.access.proxmox
     nixos.access.plex
+    nixos.samba
     ./reisen-ssh.nix
   ];
 
@@ -132,6 +134,8 @@ in {
 
   services.tailscale.advertiseExitNode = true;
 
+  services.samba.openFirewall = true;
+
   systemd.network.networks.eth0 = {
     name = "eth0";
     matchConfig = {

systems/reimu/nixos.nix

@@ -11,7 +11,6 @@
     nixos.kyuuto
     nixos.tailscale
     nixos.nfs
-    nixos.samba
   ];
 
   kyuuto.setup = true;

systems/reisen/bin/mkpam.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -eu
+
+ARG_NAME=$1
+ARG_UID=$2
+shift 2
+
+if [[ $ARG_UID != 8??? ]]; then
+	echo "uid $ARG_UID out of range" >&2
+	exit 1
+fi
+
+id_exists() {
+	ARG_FILE=$1
+	if grep -q "^${ARG_NAME}:x:" "${ARG_FILE}"; then
+		if ! grep -q "^${ARG_NAME}:x:${ARG_UID}:" "${ARG_FILE}"; then
+			echo "${ARG_NAME} already exists but with unexpected id" >&2
+			exit 1
+		fi
+		return 0
+	else
+		return 1
+	fi
+}
+
+if ! id_exists /etc/group; then
+	echo "creating group $ARG_NAME=$ARG_UID..." >&2
+	groupadd \
+		-g "$ARG_UID" \
+		"$ARG_NAME"
+fi
+
+if ! id_exists /etc/passwd; then
+	echo "creating user $ARG_NAME=$ARG_UID..." >&2
+	useradd -r \
+		-M -d /nonexistent -s /usr/sbin/nologin \
+		-N -g "$ARG_UID" \
+		-u "$ARG_UID" \
+		"$ARG_NAME"
+fi

systems/reisen/setup.sh

@@ -66,7 +66,7 @@ WRAPPERBIN=/opt/infra/sbin
 SUDOERS_INFRABINS=
 rm -f "$INFRABIN/"* "$WRAPPERBIN/"*
 mkdir -m 0755 -p "$INFRABIN" "$WRAPPERBIN"
-for infrabin in putfile64 pve ct-config; do
+for infrabin in putfile64 pve mkpam ct-config; do
 	infrainput="${infrabin//-/_}"
 	infrainput="INPUT_INFRA_${infrainput^^}"
 	printf '%s\n' "${!infrainput}" | base64 -d > "$WRAPPERBIN/$infrabin"

systems/reisen/users.json

@@ -0,0 +1,29 @@
+[
+  {
+    "authorizedKeys": [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCocjQqiDIvzq+Qu3jkf7FXw5piwtvZ1Mihw9cVjdVcsra3U2c9WYtYrA3rS50N3p00oUqQm9z1KUrvHzdE+03ZCrvaGdrtYVsaeoCuuvw7qxTQRbItTAEsfRcZLQ5c1v/57HNYNEsjVrt8VukMPRXWgl+lmzh37dd9w45cCY1QPi+JXQQ/4i9Vc3aWSe4X6PHOEMSBHxepnxm5VNHm4PObGcVbjBf0OkunMeztd1YYA9sEPyEK3b8IHxDl34e5t6NDLCIDz0N/UgzCxSxoz+YJ0feQuZtud/YLkuQcMxW2dSGvnJ0nYy7SA5DkW1oqcy6CGDndHl5StOlJ1IF9aGh0gGkx5SRrV7HOGvapR60RphKrR5zQbFFka99kvSQgOZqSB3CGDEQGHv8dXKXIFlzX78jjWDOBT67vA/M9BK9FS2iNnBF5x6shJ9SU5IK4ySxq8qvN7Us8emkN3pyO8yqgsSOzzJT1JmWUAx0tZWG/BwKcFBHfceAPQl6pwxx28TM3BTBRYdzPJLTkAy48y6iXW6UYdfAPlShy79IYjQtEThTuIiEzdzgYdros0x3PDniuAP0KOKMgbikr0gRa6zahPjf0qqBnHeLB6nHAfaVzI0aNbhOg2bdOueE1FX0x48sjKqjOpjlIfq4WeZp9REr2YHEsoLFOBfgId5P3BPtpBQ== yubikey5",
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPsu3vNsvBb/G+wALpstD/DnoRZ3fipAs00jtl8rzDuv96RlS7AJr4aNvG6Pt2D9SYn2wVLaiw+76mz2gOycH9/N+VCvL4/0MN9uqj+7XIcxNRo0gHVOblmi2bOXcmGKh3eRwHj1xyDwRxo9WIuBEP2bPpDPz75OXRtEdlTgvky7siSguQxJu03cb0p9hNAYhUoohNXyWW2CjDCLUQVE1+QRVUzsKq3KkPy0cHYgmZC1gRSMQyKpMt72L5tayLz3Tp/zrshucc+QO5IJeZdqMxsNAcvALsysT1J5EqxZoYH9VpWLRhSgVD6Nvn853pycJAlXQxgOCpSD3/v/JbgUe5NE+ci0o7NMy5IiHUv2gQMRIEhwBHlRGwokUPL9upx0lsjaEiPya5xQqqDKRom87xytM778ANS5CuMdQMWg9qVbpHZUHMjA0QmNkjPgq71pUDXHk5L4mZuS8wVjyjnvlw68yIJuHEc8P7QiLcjvRHFS2L9Ck8NRmPDTQXlQi9kk6LmMyu6fdevR/kZL21b+xO1e2DMyxBbNDTot8luppiiL8adgUDMwptpIne7JCWB1o9NFCbXUVgwuCCYBif6pOGSc6bGo1JTAKMflRlcy6Mi3t5H0mR2lj/sCSTWwTlP5FM4aPIq08NvW6PeuK1bFJY9fIgTwVsUnbAKOhmsMt62w== cardno:12 078 454",
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII74JrgGsDQ6r7tD7+k3ykxXV7DpeeFRscPMxrBsDPhz kat@goliath",
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDkeBFF4xxZgeURLzNHcvUFxImmkQ3pxXtpj3mtSyHXB kat@koishi"
+    ],
+    "name": "kat",
+    "uid": 8000
+  },
+  {
+    "authorizedKeys": [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8Z6briIboxIdedPGObEWB6QEQkvxKvnMW/UVU9t/ac mew-pgp"
+    ],
+    "name": "arc",
+    "uid": 8001
+  },
+  {
+    "authorizedKeys": [],
+    "name": "kaosubaloo",
+    "uid": 8002
+  },
+  {
+    "authorizedKeys": [],
+    "name": "connieallure",
+    "uid": 8003
+  }
+]