feat: migrate remaining applications, services, and user configurations

users/apps/default.nix

@@ -0,0 +1,18 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.homelab.users.apps;
+in {
+  options.homelab.users.apps.enable = lib.mkEnableOption "user Apps";
+
+  config.users = lib.mkIf cfg.enable {
+    groups.apps.gid = lib.mkForce 568;
+    users.apps = {
+      uid = lib.mkForce 568;
+      isSystemUser = true;
+      group = config.users.groups.apps.name;
+      home = "/var/empty";
+      shell = null;
+    };
+  };
+}

users/backup/default.nix

@@ -0,0 +1,21 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.homelab.users.backup;
+in {
+  options.homelab.users.backup.enable = lib.mkEnableOption "user Backup";
+
+  config = lib.mkIf cfg.enable {
+    users.users.backup = {
+      description = "Backup User";
+      isNormalUser = true;
+      extraGroups = [
+        "docker" # Allow access to the docker socket.
+      ];
+      openssh.authorizedKeys.keys = [
+        # Hugo
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICms6vjhE9kOlqV5GBPGInwUHAfCSVHLI2Gtzee0VXPh"
+      ];
+    };
+  };
+}

users/default.nix

@@ -1,5 +1,9 @@
 {
   imports = [
     ./admin
+    ./apps
+    ./backup
+    ./deploy
+    ./media
   ];
 }

users/deploy/default.nix

@@ -0,0 +1,49 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.homelab.users.deploy;
+in {
+  options.homelab.users.deploy.enable = lib.mkEnableOption "user Deploy";
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      groups.deploy = { };
+
+      # The user used to deploy rebuilds without password authentication
+      users.deploy = {
+        group = config.users.groups.deploy.name;
+        isSystemUser = true;
+        home = "/var/empty";
+        shell = pkgs.bashInteractive;
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPrG+ldRBdCeHEXrsy/qHXIJYg8xQXVuiUR0DxhFjYNg"
+        ];
+      };
+    };
+
+    security.sudo.extraRules = [
+      {
+        groups = [
+          config.users.groups.deploy.name
+        ];
+        commands = [
+          {
+            command = "/nix/store/*-nix-*/bin/nix-env -p /nix/var/nix/profile/system --set /nix/store/*-*";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+      {
+        groups = [
+          config.users.groups.deploy.name
+        ];
+        commands = [
+          {
+            command = "/nix/store/*/bin/switch-to-configuration";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+  };
+}

users/media/default.nix

@@ -0,0 +1,18 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.homelab.users.media;
+in {
+  options.homelab.users.media.enable = lib.mkEnableOption "user Media";
+
+  config.users = lib.mkIf cfg.enable {
+    groups.media.gid = lib.mkForce 3000;
+    users.media = {
+      uid = lib.mkForce 3001;
+      isSystemUser = true;
+      group = config.users.groups.media.name;
+      home = "/var/empty";
+      shell = null;
+    };
+  };
+}