config-perso/BOcal/net-user/configuration.nix

distant-users-id:
{
  pkgs,
  lib,
  users,
  mods,
  ...
}:
{
  imports = [
    <nixos/nixos/modules/installer/netboot/netboot.nix>
    <nixos/nixos/modules/installer/cd-dvd/channel.nix>
    <home-manager/nixos>
    (users.root { ssh = true; })
  ];
  system.stateVersion = "23.11";
  networking = {
    hostName = "net-bocal";
    firewall.enable = false;
  };
  time.timeZone = "Europe/Paris";
  i18n.defaultLocale = "fr_FR.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    keyMap = "fr";
  };
  environment.systemPackages = with pkgs; [ git ];
  security.polkit.extraConfig = ''
    polkit.addRule(function(action, subject) {
      if (
        subject.isInGroup("bocal")
          && (
            //action.id == "org.freedesktop.login1.chvt" ||
            action.id == "org.freedesktop.accounts.change-own-password" ||
            action.id == "org.freedesktop.locale1.set-keyboard" ||
            action.id == "org.freedesktop.locale1.set-locale" ||
            action.id == "org.freedesktop.login1.attach-device" ||
            action.id == "org.freedesktop.login1.flush-devices" ||
            action.id == "org.freedesktop.login1.halt" ||
            action.id == "org.freedesktop.login1.halt-ignore-inhibit" ||
            action.id == "org.freedesktop.login1.halt-multiple-sessions" ||
            action.id == "org.freedesktop.login1.hibernate" ||
            action.id == "org.freedesktop.login1.hibernate-ignore-inhibit" ||
            action.id == "org.freedesktop.login1.hibernate-multiple-sessions" ||
            action.id == "org.freedesktop.login1.inhibit-block-idle" ||
            action.id == "org.freedesktop.login1.inhibit-block-shutdown" ||
            action.id == "org.freedesktop.login1.inhibit-block-sleep" ||
            action.id == "org.freedesktop.login1.inhibit-delay-shutdown" ||
            action.id == "org.freedesktop.login1.inhibit-delay-sleep" ||
            action.id == "org.freedesktop.login1.inhibit-handle-hibernate-key" ||
            action.id == "org.freedesktop.login1.inhibit-handle-lid-switch" ||
            action.id == "org.freedesktop.login1.inhibit-handle-power-key" ||
            action.id == "org.freedesktop.login1.inhibit-handle-reboot-key" ||
            action.id == "org.freedesktop.login1.inhibit-handle-suspend-key" ||
            action.id == "org.freedesktop.login1.lock-sessions" ||
            action.id == "org.freedesktop.login1.manage" ||
            action.id == "org.freedesktop.login1.power-off" ||
            action.id == "org.freedesktop.login1.power-off-ignore-inhibit" ||
            action.id == "org.freedesktop.login1.power-off-multiple-sessions" ||
            action.id == "org.freedesktop.login1.reboot" ||
            action.id == "org.freedesktop.login1.reboot-ignore-inhibit" ||
            action.id == "org.freedesktop.login1.reboot-multiple-sessions" ||
            action.id == "org.freedesktop.login1.set-reboot-parameter" ||
            action.id == "org.freedesktop.login1.set-reboot-to-boot-loader-entry" ||
            action.id == "org.freedesktop.login1.set-reboot-to-boot-loader-menu" ||
            action.id == "org.freedesktop.login1.set-reboot-to-firmware-setup" ||
            action.id == "org.freedesktop.login1.set-self-linger" ||
            action.id == "org.freedesktop.login1.set-user-linger" ||
            action.id == "org.freedesktop.login1.set-wall-message" ||
            action.id == "org.freedesktop.login1.suspend" ||
            action.id == "org.freedesktop.login1.suspend-ignore-inhibit" ||
            action.id == "org.freedesktop.login1.suspend-multiple-sessions"
          )
        )
      {
        return polkit.Result.NO;
      }
    })
  '';

  users.groups.bocal.gid = 2000;
  users.users =
    let
      template =
        { name, uid }:
        {
          inherit name;
          value = {
            isNormalUser = true;
            inherit uid;
            shell = pkgs.zsh;
            group = "bocal";
            homeMode = "750";
          };
        };
    in
    builtins.listToAttrs (map template distant-users-id)
    // {
      root.hashedPassword = "$y$j9T$GK2ejPfMgk0GlBqZX0aBo/$n3nds9zcBi8X8p9aG5Aywq1A.R6Bt/dIOccvfIdMM/1";
      root.openssh.authorizedKeys.keys = [
        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCvi5VUsDrwS4XqQQfFFIx1JoRDPVdtChUQWqKFbPFtP8gH51woXiKtKRbDebL0z/EmkdYKxxIkzixHTR5xQXjo8JiFZbwldZi5IvMr3x//ad9sVyOhmbRx1DXLKjyOdWyo+w0vORvbEDu2lHktfSvhHGrvUHfFc3EY+cAl7IImgGEeGNPruAuNkN90Lth9QgwJVsdOEs9j7hwwKtpfMMETL5tkW34Nu7io03+SaPxwi2xLuWTdTklfZ7GWYtG2w/hFkzDbkW97rp5dxB1HO58cPqyRlqyfhZFpiUmWlyuMba3Tip6JarCa52IpFffEIDR0CSeh5CFPoeppo/TPDiXDie370TjjQpxJiG+9PobBhmChH5FmQ/lksffI/WimqpVO7Ixf5cYiHN5Z0mgJgZsXwI3YPICQLA8ebSKHA8+mdmkunDmCBRaBj1qEgkp/UoYqXT6BjBm07nOsnL+3SG/yfx4fLotgWtdm2mkjEAG+OGVR7G3Vk/POxn0EqX7Z+gU= sylvain@idefix"
      ];
    };
  home-manager.users =
    let
      template =
        { name, uid }:
        {
          inherit name;
          value = {
            home.stateVersion = "23.11";
            imports = with mods.home; [
              zsh
              neovim
            ];
            programs.zsh.profileExtra = "exec ${pkgs.plasma5Packages.plasma-workspace}/bin/startplasma-wayland";
            programs.firefox.enable = true;
            home.packages = with pkgs; [ gedit ];
          };
        };
    in
    builtins.listToAttrs (map template distant-users-id);

  services.getty = {
    loginProgram = pkgs.writeShellScript "autologin" ''
      ${pkgs.sudo}/bin/sudo -u $BOCAL rm /home/$BOCAL/.local/state/nix/profiles/home-manager*
      ${pkgs.sudo}/bin/sudo -u $BOCAL rm /home/$BOCAL/.local/state/home-manager/gcroots/current-home
      ${pkgs.systemd}/bin/systemctl restart home-manager-''${BOCAL}.service
      exec ${pkgs.shadow}/bin/login -f $BOCAL
    '';
    autologinUser = "bocal";
  };
  systemd.services.unlock = {
    wantedBy = [ "multi-user.target" ];
    script = ''
      ${pkgs.dbus}/bin/dbus-monitor --system "type='signal',interface='org.freedesktop.DBus.Properties',path_namespace='/org/freedesktop/login1/session'" | while read x; do
        case "$x" in
          *"boolean true"*) ${pkgs.systemd}/bin/loginctl unlock-sessions
        esac
      done
    '';
  };
  services.xserver = {
    enable = true;
    xkb.layout = "fr";
    desktopManager.plasma5.enable = true;
    displayManager.lightdm.enable = false;
  };
  fileSystems =
    let
      template =
        { name, uid }:
        {
          name = "/home/${name}";
          value = {
            device = "192.168.222.1:/home/${name}";
            fsType = "nfs";
          };
        };
    in
    {
      "/home/bocal" = {
        device = "192.168.222.1:/home/bocal";
        fsType = "nfs";
      };
    }
    // builtins.listToAttrs (map template distant-users-id);
}