naturallaw777
4a25ef24d1
The Hub, GDM and sudo now share /etc/shadow as the single source of
truth. /var/lib/secrets/{free,root}-password become root-only display
copies, written only by system_password.py and verified against shadow
before being shown. The GNOME login keyring is decoupled from the login
password (blank master password, pam_gnome_keyring off), so nothing
needs re-keying or wiping when the password changes and the keyring
never pops an unlock prompt.
- add app/sovran_systemsos_web/system_password.py: the single module
that verifies / sets / displays the free + root passwords and drives
the legacy-migration onboarding step (same endpoints and UI)
- add modules/password-model.nix: PAM gnome-keyring off, blank
login.keyring seed with a one-time migration of old encrypted
keyrings, first-boot-only password application (no more boot-revert),
LIBCRYPT for the Hub
- server.py: login verifies against shadow and heals stale display
copies; change-password takes the current password; security reset
sets both passwords through the same writer (root is shown as a
password again, not a hash); all keyring wipes removed
- credentials.nix: drop root-password-setup, free-password-setup and
free-password-migration (replaced by password-model.nix) and the
keyring wipe in change-free-password
- configuration.nix: drop enableGnomeKeyring and the keyring tmpfiles
hack (replaced by password-model.nix)
- service-detail.js: "Current password" field; credentials changed
outside the Hub render with a hint instead of a stale value
Installed machines keep their exact passwords: the first-boot services
no-op once an account has a real hash, and the upgrade never writes
/etc/shadow. The legacy-migration onboarding step and "reset all
passwords" keep working.
40 lines
1.1 KiB
Nix
Executable File
40 lines
1.1 KiB
Nix
Executable File
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
imports = [
|
|
# ── Core (always loaded) ──────────────────────────────────
|
|
./core/roles.nix
|
|
./core/role-logic.nix
|
|
./core/caddy.nix
|
|
./core/njalla.nix
|
|
./core/ssh-bootstrap.nix
|
|
./core/tech-support.nix
|
|
./core/sovran_systemsos-desktop.nix
|
|
./core/sshd-localhost.nix
|
|
./core/sovran-hub.nix
|
|
./core/legacy-cleanup.nix
|
|
./core/remote-deploy.nix
|
|
./core/no-sleep.nix
|
|
./core/cpu-performance.nix
|
|
./core/local-domain-loopback.nix
|
|
|
|
# ── Always on (no flag) ───────────────────────────────────
|
|
./php.nix
|
|
./credentials.nix
|
|
./password-model.nix
|
|
|
|
# ── Services (default ON — disable in custom.nix) ─────────
|
|
./synapse.nix
|
|
./wordpress.nix
|
|
./nextcloud.nix
|
|
./vaultwarden.nix
|
|
./wallet-autoconnect.nix
|
|
|
|
# ── Features (default OFF — enable in custom.nix) ─────────
|
|
./haven.nix
|
|
./element-calling.nix
|
|
./rdp.nix
|
|
./sshd.nix
|
|
];
|
|
}
|