FMO-85: Rebase ghaf 24.12 (#96)

- Update flake.lock for ghaf 24.12 - Currently admin user is used for all VMs, while there could be different users for different VMs - Temporarily disable hardened greetd.service as it disables sudo (to be used in guivm) but FMO-OS uses gui in host Signed-off-by: Anh Huy Bui <[email protected]>
tiiuae · Dec 27, 2024 · f295015 · f295015
1 parent 7e7ed91
commit f295015
Show file tree

Hide file tree

Showing 6 changed files with 97 additions and 64 deletions.
diff --git a/flake.lock b/flake.lock
diff --git a/modules/desktop/graphics/sway/sway.ini.nix b/modules/desktop/graphics/sway/sway.ini.nix
@@ -51,13 +51,13 @@ in {
         config-folder = {
           des-path = "${config.users.users.ghaf.home}/.config";
           write-once = true;
-          owner = config.ghaf.users.accounts.user;
+          owner = config.ghaf.users.admin.name;
         };
         sway-config = {
           source = "${swayConfig}/config";
           des-path = "${config.users.users.ghaf.home}/.config/sway";
           write-once = true;
-          owner = config.ghaf.users.accounts.user;
+          owner = config.ghaf.users.admin.name;
           permission = "664";
         };
       };

diff --git a/modules/desktop/graphics/sway/sway.nix b/modules/desktop/graphics/sway/sway.nix
@@ -56,6 +56,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    ghaf.users.admin = {
+      createHome = lib.mkForce true;
+    };
 
     xdg.icons.enable = true;
 

diff --git a/modules/packages/fmo-qemu/default.nix b/modules/packages/fmo-qemu/default.nix
@@ -7,7 +7,7 @@
 let
   inherit (pkgs) lib;
 
-  inherit (import "${ghafOS.inputs.microvm}/lib" { nixpkgs-lib = lib; }) createVolumesScript makeMacvtap;
+  inherit (import "${ghafOS.inputs.microvm}/lib" { inherit lib; }) createVolumesScript makeMacvtap;
   inherit (makeMacvtap {
     inherit microvmConfig hypervisorConfig;
   }) openMacvtapFds macvtapFds;

diff --git a/modules/profiles/x86.nix b/modules/profiles/x86.nix
@@ -28,6 +28,9 @@ in
 
       profiles.applications.enable = true;
 
+      # TODO: Hardened greetd disabled sudo, should be fixed when implement guivm
+      systemd.excludedHardenedConfigs = [ "greetd.service"];
+
       virtualization= {
         microvm-host.enable = true;
         microvm-host.networkSupport = true;

diff --git a/modules/virtualization/microvm/vm.nix b/modules/virtualization/microvm/vm.nix
@@ -16,7 +16,8 @@
     imports = [
       ({lib, ...}: {
         ghaf = {
-          users.accounts.enable = lib.mkDefault configHost.ghaf.users.accounts.enable;
+          # TODO: Ghaf implement different types of users. Currently use admin user for all VMs
+          users.admin.enable = lib.mkDefault configHost.ghaf.users.admin.enable;
           development = {
             ssh.daemon.enable = lib.mkDefault configHost.ghaf.development.ssh.daemon.enable;
             debug.tools.enable = lib.mkDefault configHost.ghaf.development.debug.tools.enable;