refactor: fix several minor bugs and potential security issues

features/docker.nix

@@ -1,4 +1,15 @@
 { _, ... }:
 {
-  virtualisation.docker.enable = true;
+  virtualisation.docker = {
+    enable = true;
+
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+
+      daemon.settings = {
+        data-root = "$XDG_DATA_HOME/docker";
+      };
+    };
+  };
 }

features/sudo.nix

@@ -0,0 +1,7 @@
+{ _, ... }:
+{
+  security.sudo = {
+    enable = true;
+    wheelNeedsPassword = true;
+  };
+}

hosts/nero/configuration.nix

@@ -46,10 +46,6 @@
           appId = "com.vysp3r.ProtonPlus";
           origin = "flathub";
         }
-        {
-          appId = "io.mpv.Mpv";
-          origin = "flathub";
-        }
         {
           appId = "org.ghidra_sre.Ghidra";
           origin = "flathub";

hosts/nero/hardware.nix

@@ -54,7 +54,7 @@
     };
 
     "/mnt/fileshare" = {
-      device = "frank@192.168.1.181:/mnt/shares";
+      device = "frank@vergil.cfl.rr.com:/mnt/shares";
       fsType = "sshfs";
       options = [
         "uid=1000"

hosts/shared/nixos-pc.nix

@@ -13,6 +13,7 @@
     ../../features/avahi.nix
     ../../features/systemd-boot.nix
     ../../features/i18n.nix
+    ../../features/sudo.nix
     ./nix-package-manager.nix
   ];
 
@@ -172,7 +173,6 @@
       "wheel"
       "input"
       "video"
-      "docker"
       "uinput"
     ];
   };

hosts/shared/nixos-server.nix

@@ -11,6 +11,7 @@
     ../../features/avahi.nix
     ../../features/systemd-boot.nix
     ../../features/i18n.nix
+    ../../features/sudo.nix
     ./nix-package-manager.nix
   ];
 
@@ -72,7 +73,6 @@
     extraGroups = [
       "wheel"
       "libvirtd"
-      "docker"
     ];
   };
 

hosts/vergil/configuration.nix

@@ -31,12 +31,14 @@
     };
   };
 
-  users.users."remotebuild" = {
+  users.users = {
+    "remotebuild" = {
       isSystemUser = true;
       group = "remotebuild";
       useDefaultShell = true;
       openssh.authorizedKeys.keyFiles = [ ./remotebuild.pub ];
     };
+  };
 
   users.groups.remotebuild = { };
   nix.settings.trusted-users = [ "remotebuild" ];
@@ -86,7 +88,7 @@
     jellyfin = {
       enable = true;
       openFirewall = true;
-      user = "frank";
+      user = "jellyfin";
     };
   };