initial restructuring

old/system/security/default.nix

@@ -0,0 +1,29 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./sops.nix
+    ./sudo.nix
+    ./systemd.nix
+    ./users.nix
+  ];
+
+  systemd.user.services.niri-flake-polkit.enable = false;
+
+  security = {
+    pam.services.swaylock = {};
+    polkit.enable = true;
+    rtkit.enable = true;
+
+    tpm2 = {
+      enable = true;
+      pkcs11.enable = true;
+      tctiEnvironment.enable = true;
+    };
+  };
+
+
+  services.udev.extraRules = ''
+    KERNEL=="uinput", MODE="0660", GROUP="input", OPTIONS+="static_node=uinput"
+  '';
+}

old/system/security/sops.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."vaultwarden_clientid".owner = config.users.users.jashton.name;
+  sops.secrets."vaultwarden_clientsecret".owner = config.users.users.jashton.name;
+}

old/system/security/sudo.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+
+{
+  security.sudo.extraRules = [
+    {
+      users = [ "jashton" ];
+
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/tlp";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+}

old/system/security/systemd.nix

@@ -0,0 +1,3 @@
+{ config, pkgs, ... }:
+
+{}

old/system/security/thinkpad.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.fprintd = {
+    enable = true;
+    #tod.enable = true;
+    #tod.driver = pkgs.libfprint-2-tod1-goodix;
+  };
+}

old/system/security/users.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, ... }:
+
+{
+  users.groups.jashton = {};
+  users.groups.greetd = {};
+  users.groups.heliotrope-backups = {};
+
+  users.users.jashton = {
+    isNormalUser = true;
+    description = "Josh Ashton";
+    group = "jashton";
+    extraGroups = [ "networkmanager" "wheel" "tss" "video" "audio" "input" ];
+
+    shell = pkgs.zsh;
+  };
+
+  users.users.heliotrope-backups = {
+    isNormalUser = true;
+    description = "heliotrope remote server backups.";
+    group = "heliotrope-backups";
+
+    shell = pkgs.bash;
+  };
+
+  users.users.root = {
+    shell = pkgs.zsh;
+  };
+
+  users.extraUsers.greetd = {
+    isSystemUser = true;
+    group = "greetd";
+    extraGroups = [ "input" ];
+  };
+}