···

       
428
       
 
       


     

       
429
       
 
       
  uidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) cfg.users) "uid";

     

       
430
       
 
       
  gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.groups) "gid";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
431
       
 
       


     

       
432
       
 
       
  spec = pkgs.writeText "users-groups.json" (builtins.toJSON {

     

       
433
       
 
       
    inherit (cfg) mutableUsers;

     
···

       
534
       
 
       
        WARNING: enabling this can lock you out of your system. Enable this only if you know what are you doing.

     

       
535
       
 
       
      '';

     

       
536
       
 
       
    };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
537
       
 
       
  };

     

       
538
       
 
       


     

       
539
       
 
       


     
···

       
639
       
 
       
      "/etc/profiles/per-user/$USER"

     

       
640
       
 
       
    ];

     

       
641
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
642
       
 
       
    assertions = [

     

       
643
       
 
       
      { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);

     

       
644
       
 
       
        message = "UIDs and GIDs must be unique!";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
645
       
 
       
      }

     

       
646
       
 
       
      { # If mutableUsers is false, to prevent users creating a

     

       
647
       
 
       
        # configuration that locks them out of the system, ensure that

     

···

       
428
       
 
       


     

       
429
       
 
       
  uidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) cfg.users) "uid";

     

       
430
       
 
       
  gidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) cfg.groups) "gid";

     

       
431
       
+
       
  sdInitrdUidsAreUnique = idsAreUnique (filterAttrs (n: u: u.uid != null) config.boot.initrd.systemd.users) "uid";

     

       
432
       
+
       
  sdInitrdGidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) config.boot.initrd.systemd.groups) "gid";

     

       
433
       
 
       


     

       
434
       
 
       
  spec = pkgs.writeText "users-groups.json" (builtins.toJSON {

     

       
435
       
 
       
    inherit (cfg) mutableUsers;

     
···

       
536
       
 
       
        WARNING: enabling this can lock you out of your system. Enable this only if you know what are you doing.

     

       
537
       
 
       
      '';

     

       
538
       
 
       
    };

     

       
539
       
+
       


     

       
540
       
+
       
    # systemd initrd

     

       
541
       
+
       
    boot.initrd.systemd.users = mkOption {

     

       
542
       
+
       
      visible = false;

     

       
543
       
+
       
      description = ''

     

       
544
       
+
       
        Users to include in initrd.

     

       
545
       
+
       
      '';

     

       
546
       
+
       
      default = {};

     

       
547
       
+
       
      type = types.attrsOf (types.submodule ({ name, ... }: {

     

       
548
       
+
       
        options.uid = mkOption {

     

       
549
       
+
       
          visible = false;

     

       
550
       
+
       
          type = types.int;

     

       
551
       
+
       
          description = ''

     

       
552
       
+
       
            ID of the user in initrd.

     

       
553
       
+
       
          '';

     

       
554
       
+
       
          defaultText = literalExpression "config.users.users.\${name}.uid";

     

       
555
       
+
       
          default = cfg.users.${name}.uid;

     

       
556
       
+
       
        };

     

       
557
       
+
       
        options.group = mkOption {

     

       
558
       
+
       
          visible = false;

     

       
559
       
+
       
          type = types.singleLineStr;

     

       
560
       
+
       
          description = ''

     

       
561
       
+
       
            Group the user belongs to in initrd.

     

       
562
       
+
       
          '';

     

       
563
       
+
       
          defaultText = literalExpression "config.users.users.\${name}.group";

     

       
564
       
+
       
          default = cfg.users.${name}.group;

     

       
565
       
+
       
        };

     

       
566
       
+
       
      }));

     

       
567
       
+
       
    };

     

       
568
       
+
       


     

       
569
       
+
       
    boot.initrd.systemd.groups = mkOption {

     

       
570
       
+
       
      visible = false;

     

       
571
       
+
       
      description = ''

     

       
572
       
+
       
        Groups to include in initrd.

     

       
573
       
+
       
      '';

     

       
574
       
+
       
      default = {};

     

       
575
       
+
       
      type = types.attrsOf (types.submodule ({ name, ... }: {

     

       
576
       
+
       
        options.gid = mkOption {

     

       
577
       
+
       
          visible = false;

     

       
578
       
+
       
          type = types.int;

     

       
579
       
+
       
          description = ''

     

       
580
       
+
       
            ID of the group in initrd.

     

       
581
       
+
       
          '';

     

       
582
       
+
       
          defaultText = literalExpression "config.users.groups.\${name}.gid";

     

       
583
       
+
       
          default = cfg.groups.${name}.gid;

     

       
584
       
+
       
        };

     

       
585
       
+
       
      }));

     

       
586
       
+
       
    };

     

       
587
       
 
       
  };

     

       
588
       
 
       


     

       
589
       
 
       


     
···

       
689
       
 
       
      "/etc/profiles/per-user/$USER"

     

       
690
       
 
       
    ];

     

       
691
       
 
       


     

       
692
       
+
       
    # systemd initrd

     

       
693
       
+
       
    boot.initrd.systemd = lib.mkIf config.boot.initrd.systemd.enable {

     

       
694
       
+
       
      contents = {

     

       
695
       
+
       
        "/etc/passwd".text = ''

     

       
696
       
+
       
          ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: { uid, group }: let

     

       
697
       
+
       
            g = config.boot.initrd.systemd.groups.${group};

     

       
698
       
+
       
          in "${n}:x:${toString uid}:${toString g.gid}::/var/empty:") config.boot.initrd.systemd.users)}

     

       
699
       
+
       
        '';

     

       
700
       
+
       
        "/etc/group".text = ''

     

       
701
       
+
       
          ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: { gid }: "${n}:x:${toString gid}:") config.boot.initrd.systemd.groups)}

     

       
702
       
+
       
        '';

     

       
703
       
+
       
      };

     

       
704
       
+
       


     

       
705
       
+
       
      users = {

     

       
706
       
+
       
        root = {};

     

       
707
       
+
       
        nobody = {};

     

       
708
       
+
       
      };

     

       
709
       
+
       


     

       
710
       
+
       
      groups = {

     

       
711
       
+
       
        root = {};

     

       
712
       
+
       
        nogroup = {};

     

       
713
       
+
       
        systemd-journal = {};

     

       
714
       
+
       
        tty = {};

     

       
715
       
+
       
        dialout = {};

     

       
716
       
+
       
        kmem = {};

     

       
717
       
+
       
        input = {};

     

       
718
       
+
       
        video = {};

     

       
719
       
+
       
        render = {};

     

       
720
       
+
       
        sgx = {};

     

       
721
       
+
       
        audio = {};

     

       
722
       
+
       
        video = {};

     

       
723
       
+
       
        lp = {};

     

       
724
       
+
       
        disk = {};

     

       
725
       
+
       
        cdrom = {};

     

       
726
       
+
       
        tape = {};

     

       
727
       
+
       
        kvm = {};

     

       
728
       
+
       
      };

     

       
729
       
+
       
    };

     

       
730
       
+
       


     

       
731
       
 
       
    assertions = [

     

       
732
       
 
       
      { assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);

     

       
733
       
 
       
        message = "UIDs and GIDs must be unique!";

     

       
734
       
+
       
      }

     

       
735
       
+
       
      { assertion = !cfg.enforceIdUniqueness || (sdInitrdUidsAreUnique && sdInitrdGidsAreUnique);

     

       
736
       
+
       
        message = "systemd initrd UIDs and GIDs must be unique!";

     

       
737
       
 
       
      }

     

       
738
       
 
       
      { # If mutableUsers is false, to prevent users creating a

     

       
739
       
 
       
        # configuration that locks them out of the system, ensure that

     

···

       
388
       
 
       


     

       
389
       
 
       
        "/etc/modules-load.d/nixos.conf".text = concatStringsSep "\n" config.boot.initrd.kernelModules;

     

       
390
       
 
       


     

       
391
       
-
       
        "/etc/passwd".source = "${pkgs.fakeNss}/etc/passwd";

     

       
392
       
 
       
        # We can use either ! or * to lock the root account in the

     

       
393
       
 
       
        # console, but some software like OpenSSH won't even allow you

     

       
394
       
 
       
        # to log in with an SSH key if you use ! so we use * instead

     

···

       
388
       
 
       


     

       
389
       
 
       
        "/etc/modules-load.d/nixos.conf".text = concatStringsSep "\n" config.boot.initrd.kernelModules;

     

       
390
       
 
       


     

       
0
       
 
       

     

       
391
       
 
       
        # We can use either ! or * to lock the root account in the

     

       
392
       
 
       
        # console, but some software like OpenSSH won't even allow you

     

       
393
       
 
       
        # to log in with an SSH key if you use ! so we use * instead

     

···

       
27
       
 
       
        machine.succeed("[ -e /dev/pts/ptmx ]") # /dev/pts

     

       
28
       
 
       
        machine.succeed("[ -e /run/keys ]") # /run/keys

     

       
29
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
30
       
 
       


     

       
31
       
 
       
    with subtest("growfs works"):

     

       
32
       
 
       
        oldAvail = machine.succeed("df --output=avail / | sed 1d")

     

···

       
27
       
 
       
        machine.succeed("[ -e /dev/pts/ptmx ]") # /dev/pts

     

       
28
       
 
       
        machine.succeed("[ -e /run/keys ]") # /run/keys

     

       
29
       
 
       


     

       
30
       
+
       
    with subtest("groups work"):

     

       
31
       
+
       
        machine.fail("journalctl -b 0 | grep 'systemd-udevd.*Unknown group.*ignoring'")

     

       
32
       
 
       


     

       
33
       
 
       
    with subtest("growfs works"):

     

       
34
       
 
       
        oldAvail = machine.succeed("df --output=avail / | sed 1d")