dotfiles/nixos-config
1
0
Fork 0
mirror of https://github.com/srid/nixos-config.git synced 2026-05-11 17:36:07 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

hercules: unconditional trust [nix]

Browse source 
Ref: https://github.com/hercules-ci/hercules-ci-agent/issues/345#issuecomment-986329977
This commit is contained in:
Sridhar Ratnakumar 2021-12-05 19:15:07 -05:00
parent e36a0ad6d6
commit 59d48328f8
7 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
containers/hercules.nix
View file

@ -11,6 +11,14 @@
"https://hercules-ci.cachix.org"
];
# FIXME: User id of `hercules-ci-agent` won't match that of guest, so we do
# this. But it compromises security. See
# https://github.com/hercules-ci/hercules-ci-agent/issues/345#issuecomment-986329977
#
# TODO: Find a way to resolve this.
nix.allowedUsers = [ "*" ];
nix.trustedUsers = [ "*" ];
containers.hercules = {
ephemeral = false;
autoStart = true;
@ -20,6 +28,7 @@
];
services.hercules-ci-agent.enable = true;
services.hercules-ci-agent.settings.concurrentTasks = 4;
services.hercules-ci-agent.settings.nixUserIsTrusted = lib.mkForce false;
networking.firewall.allowedTCPPorts = [ ];
};

1
features/server/harden.nix
View file

@ -20,4 +20,5 @@
};
};
nix.allowedUsers = [ "root" "srid" ];
nix.trustedUsers = [ "root" "srid" ];
}

1
hosts/facade.nix
View file

@ -13,7 +13,6 @@
extraOptions = ''
experimental-features = nix-command flakes
'';
trustedUsers = [ "root" "srid" ];
};
environment.systemPackages = with pkgs; [

1
hosts/hetzner/ax101.nix
View file

@ -105,7 +105,6 @@
extraOptions = ''
experimental-features = nix-command flakes
'';
trustedUsers = [ "root" "srid" ];
};
services.netdata.enable = true;

1
hosts/hetzner/ax61-nvme.nix
View file

@ -104,7 +104,6 @@
extraOptions = ''
experimental-features = nix-command flakes
'';
trustedUsers = [ "root" "srid" ];
};
services.netdata.enable = true;

1
hosts/thick.nix
View file

@ -57,7 +57,6 @@
extraOptions = ''
experimental-features = nix-command flakes
'';
trustedUsers = [ "root" "srid" ];
};
networking.hostName = "thick"; # Define your hostname.

1
hosts/thin.nix
View file

@ -41,7 +41,6 @@
extraOptions = ''
experimental-features = nix-command flakes
'';
trustedUsers = [ "root" "srid" ];
};
networking.hostName = "thin";