fix(treewide): Add constant uids and gids to each user and group

This allows us to avoid persisting `/var/lib/nixos`.

7 files changed, 132 insertions, 0 deletions

diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix
new file mode 100644
index 0000000..a28ea0c
--- /dev/null
+++ b/modules/by-name/co/constants/module.nix
@@ -0,0 +1,43 @@
+# This file is inspired by the `nixos/modules/misc/ids.nix`
+# file in nixpkgs.
+{lib, ...}: {
+  options.vhack.constants = {
+    ids.uids = lib.mkOption {
+      internal = true;
+      description = ''
+        The user IDs used in the vhack.eu nixos config.
+      '';
+      type = lib.types.attrsOf lib.types.int;
+    };
+    ids.gids = lib.mkOption {
+      internal = true;
+      description = ''
+        The group IDs used in the vhack.eu nixos config.
+      '';
+      type = lib.types.attrsOf lib.types.int;
+    };
+  };
+
+  config.vhack.constants = {
+    ids.uids = {
+      acme = 328;
+      dhcpcd = 329;
+      nscd = 330;
+      sshd = 331;
+      systemd-oom = 332;
+
+      # As per the NixOS file, the uids should not be greater or equal to 400;
+    };
+    ids.gids = {
+      acme = 328;
+      dhcpcd = 329;
+      nscd = 330;
+      sshd = 331;
+      systemd-oom = 332;
+      resolvconf = 333; # This group is not matched to an user?
+      systemd-coredump = 151; # matches systemd-coredump user
+
+      # The gid should match the uid. Thus should not be >= 400;
+    };
+  };
+}
diff --git a/modules/by-name/co/coredump/module.nix b/modules/by-name/co/coredump/module.nix
new file mode 100644
index 0000000..ce28ed9
--- /dev/null
+++ b/modules/by-name/co/coredump/module.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.vhack.systemd.coredump;
+in {
+  options.vhack.systemd.coredump = {
+    # NOTE(@bpeetz): Enabled by default, because that is what NixOS also does. <2024-12-25>
+    enable = (lib.mkEnableOption "oomd") // {default = true;};
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      groups.systemd-coredump.gid = config.vhack.constants.ids.gids.systemd-coredump;
+    };
+  };
+}
diff --git a/modules/by-name/ng/nginx/module.nix b/modules/by-name/ng/nginx/module.nix
index 9c77652..1e9b626 100644
--- a/modules/by-name/ng/nginx/module.nix
+++ b/modules/by-name/ng/nginx/module.nix
@@ -39,6 +39,12 @@ in {
     vhack.persist.directories = [
       "/var/lib/acme"
     ];
+
+    users = {
+      users.acme.uid = config.vhack.constants.ids.uids.acme;
+      groups.acme.gid = config.vhack.constants.ids.gids.acme;
+    };
+
     security.acme = {
       acceptTerms = true;
       defaults = {
diff --git a/modules/by-name/ns/nscd/module.nix b/modules/by-name/ns/nscd/module.nix
new file mode 100644
index 0000000..428ae3b
--- /dev/null
+++ b/modules/by-name/ns/nscd/module.nix
@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.vhack.nscd;
+in {
+  options.vhack.nscd = {
+    # NOTE(@bpeetz): This is enabled by default in NixOS.
+    # Because of this reason:
+    # > Whether to enable the Name Service Cache Daemon. Disabling this is
+    # > strongly discouraged, as this effectively disables NSS Lookups from
+    # > all non-glibc NSS modules, including the ones provided by systemd.
+    #
+    # As such we should also always enable it. <2024-12-25>
+    enable = (lib.mkEnableOption "nscd") // {default = true;};
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      users.nscd.uid = config.vhack.constants.ids.uids.nscd;
+      groups.nscd.gid = config.vhack.constants.ids.gids.nscd;
+    };
+  };
+}
diff --git a/modules/by-name/oo/oomd/module.nix b/modules/by-name/oo/oomd/module.nix
new file mode 100644
index 0000000..3b39236
--- /dev/null
+++ b/modules/by-name/oo/oomd/module.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.vhack.systemd.oomd;
+in {
+  options.vhack.systemd.oomd = {
+    # NOTE(@bpeetz): Enabled by default, because that is what NixOS also does. <2024-12-25>
+    enable = (lib.mkEnableOption "oomd") // {default = true;};
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      users.systemd-oom.uid = config.vhack.constants.ids.uids.systemd-oom;
+      groups.systemd-oom.gid = config.vhack.constants.ids.gids.systemd-oom;
+    };
+  };
+}
diff --git a/modules/by-name/op/openssh/module.nix b/modules/by-name/op/openssh/module.nix
index 49290b9..83aeadf 100644
--- a/modules/by-name/op/openssh/module.nix
+++ b/modules/by-name/op/openssh/module.nix
@@ -37,6 +37,11 @@ in {
     ];
     */
 
+    users = {
+      users.sshd.uid = config.vhack.constants.ids.uids.sshd;
+      groups.sshd.gid = config.vhack.constants.ids.gids.sshd;
+    };
+
     services.openssh = {
       enable = true;
       settings.PasswordAuthentication = false;
diff --git a/modules/by-name/re/resolvconf/module.nix b/modules/by-name/re/resolvconf/module.nix
new file mode 100644
index 0000000..ff99696
--- /dev/null
+++ b/modules/by-name/re/resolvconf/module.nix
@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.vhack.resolvconf;
+in {
+  options.vhack.resolvconf = {
+    # NOTE(@bpeetz): This condition is taken directly from NixOS. <2024-12-25>
+    enable = lib.mkEnableOption "resolvconf" // {default = !(config.environment.etc ? "resolv.conf");};
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.resolvconf.gid = config.vhack.constants.ids.gids.resolvconf;
+  };
+}