ragusa-it/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Validate username once in flake

Browse Source 
Co-authored-by: ragusa-it <196988693+ragusa-it@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-01 20:58:05 +00:00
parent 7981be949f
commit 94ec2169bd
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
flake.nix
View File

@@ -40,9 +40,15 @@
hostname = "atlas"; hostname = "atlas";
username = "pinj"; username = "pinj";
lib = nixpkgs.lib; lib = nixpkgs.lib;
usernameValid =
builtins.match "^[a-z_][a-z0-9_]*$" username != null
&& builtins.match "^_+$" username == null
&& builtins.match "^nix" username == null
&& username != "root";
hostConfig = ./hosts + "/${hostname}/hardware-configuration.nix"; hostConfig = ./hosts + "/${hostname}/hardware-configuration.nix";
passwordHashPath = "/etc/nixos/secrets/${username}/password.hash"; passwordHashPath = assert usernameValid;
specialArgs = { inherit inputs system hostname username passwordHashPath; }; "/etc/nixos/secrets/${username}/password.hash";
specialArgs = { inherit inputs system hostname username usernameValid passwordHashPath; };
# Verify mango flake exports the expected module # Verify mango flake exports the expected module
mangoModule = assert lib.hasAttrByPath [ "nixosModules" "mango" ] mango; mangoModule = assert lib.hasAttrByPath [ "nixosModules" "mango" ] mango;

6
modules/common.nix
View File

@@ -1,10 +1,10 @@
{ config, pkgs, inputs, system, hostname, username, passwordHashPath, ... }: { config, pkgs, inputs, system, hostname, username, usernameValid, passwordHashPath, ... }:
{ {
assertions = [ assertions = [
{ {
assertion = builtins.match "^[a-z_][a-z0-9_]*$" username != null; assertion = usernameValid;
message = "username must be a simple system user name without path separators."; message = "username must be a simple system user name and not reserved.";
} }
]; ];
# -------------------------------------------------------------------------- # --------------------------------------------------------------------------