Coding Agent
69bc45bbf0
Declare dev, scoped sudo/SSH, workspace ownership, Git and Neovim. Lock Nixpkgs, Home Manager and the unmodified dotfiles. Deploy user files declaratively and preserve a writable Lazy lockfile. Nix formatting and pure flake evaluation pass. Full build, empty-home deployment tests and activation of this reproducibility correction are still pending; the previous account baseline is live.
36 lines
787 B
Nix
36 lines
787 B
Nix
{
|
|
users.users.dev = {
|
|
isNormalUser = true;
|
|
uid = 1001;
|
|
description = "Development user";
|
|
extraGroups = [ "wheel" ];
|
|
openssh.authorizedKeys.keyFiles = [ ./dev-authorized-keys ];
|
|
};
|
|
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ "dev" ];
|
|
commands = [
|
|
{
|
|
command = "ALL";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
home-manager = {
|
|
useGlobalPkgs = true;
|
|
useUserPackages = true;
|
|
backupFileExtension = "before-nix";
|
|
users.dev.home.stateVersion = "26.05";
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /home/dev/.config 0755 dev users -"
|
|
"d /home/dev/projects 0755 dev users -"
|
|
# Keep the working repo editable by dev. Z does not follow store symlinks.
|
|
"Z /etc/nixos - dev users -"
|
|
];
|
|
}
|