guest-base: make the operator account optional for root-only guests #11

New issue

Open

opened 2026-10-07 03:53:48 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-10-07 03:53:48 +01:00

A guest with no operator account should be able to compose the shared guest base without undoing an account it never asked for. Today modules/guest-base.nix always creates users.users.${username} as a normal user in wheel with the hypervisor's keys, and modules/qemu-guest.nix chowns /home/${username}; the new service archetype in allod/archetypes (allod/archetypes#137) is root-only, passes username = "root", and has to mkForce isNormalUser back to false and replace the key list, which works but is a trap for the next reader.

Primary goals:

An optional account — a guest composes the base with username = null (or an explicit allod.vm.operatorAccount = false) and gets sshd, the Nix settings and the runtime assertion, but no login account, no sudo, no /home chown; the hypervisor's keys then authorize root instead, since a guest with no account must still be reachable by the machine that provisions it.
Dev and privacy guests unchanged — a derivation-path comparison of every current template guest before and after is the witness (testing.md: a change that claims to change nothing is witnessed by derivation equality).
The service builder drops its forces — once this lands, mkServiceVm passes no username and removes the two mkForces and their comment.

Scope

In: modules/guest-base.nix, modules/qemu-guest.nix, the README. Out: the archetypes side, which follows under its own issue after the lock bump.

A guest with no operator account should be able to compose the shared guest base without undoing an account it never asked for. Today `modules/guest-base.nix` always creates `users.users.${username}` as a normal user in `wheel` with the hypervisor's keys, and `modules/qemu-guest.nix` chowns `/home/${username}`; the new `service` archetype in `allod/archetypes` (allod/archetypes#137) is root-only, passes `username = "root"`, and has to `mkForce` `isNormalUser` back to false and replace the key list, which works but is a trap for the next reader. Primary goals: - **An optional account** — a guest composes the base with `username = null` (or an explicit `allod.vm.operatorAccount = false`) and gets sshd, the Nix settings and the runtime assertion, but no login account, no sudo, no `/home` chown; the hypervisor's keys then authorize root instead, since a guest with no account must still be reachable by the machine that provisions it. - **Dev and privacy guests unchanged** — a derivation-path comparison of every current template guest before and after is the witness (testing.md: a change that claims to change nothing is witnessed by derivation equality). - **The service builder drops its forces** — once this lands, `mkServiceVm` passes no username and removes the two `mkForce`s and their comment. ### Scope In: `modules/guest-base.nix`, `modules/qemu-guest.nix`, the README. Out: the archetypes side, which follows under its own issue after the lock bump.