infra/users/ai-worker.nix

{ pkgs, inputs, config, keys, ... }: {
  users.users.ai-worker = {
    isSystemUser = true;
    group = "ai-worker";
    home = "/home/ai-worker";
    createHome = true;
    # ai-worker stays in docker group for normal docker operations (ps, start, stop, compose, ...)
    # Dangerous commands (exec, cp, commit) are blocked by a wrapper script.
    extraGroups = [ "docker" ];
    shell = pkgs.bashInteractive;
    openssh.authorizedKeys.keys = [
      keys.users.ai-worker.main
    ];
    # No password login - SSH key only
    hashedPassword = "!";
  };
  users.groups.ai-worker = {};

  # Enable restricted AI worker SSH access
  # SECURITY: ai-worker is in docker group but docker commands are filtered:
  #   ALLOWED: ps, images, logs, start, stop, restart, rm, rmi, pull, build, run, compose
  #   BLOCKED: exec, cp, commit, diff, export, import, load, save, attach, push
  # The filtering is done by a docker wrapper in ai-worker's PATH.
  services.aiWorkerAccess = true;

  # Restricted sudo for ai-worker - security checks only (not for docker)
  security.sudo.extraRules = [
    {
      users = [ "ai-worker" ];
      commands = [
        # Firewall checks
        {
          command = "/run/wrappers/bin/sudo iptables -L -n -v";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/wrappers/bin/sudo iptables -S";
          options = [ "NOPASSWD" ];
        }
        # Fail2ban status
        {
          command = "/run/current-system/sw/bin/fail2ban-client status";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/current-system/sw/bin/fail2ban-client status *";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/current-system/sw/bin/fail2ban-client get * banned";
          options = [ "NOPASSWD" ];
        }
        # Log inspection
        {
          command = "/run/current-system/sw/bin/journalctl -t kernel -n 100";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/current-system/sw/bin/journalctl -u fail2ban -n 50";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/current-system/sw/bin/journalctl -u firewall -n 50";
          options = [ "NOPASSWD" ];
        }
        # SSH config verification
        {
          command = "/run/current-system/sw/bin/sshd -T";
          options = [ "NOPASSWD" ];
        }
        # Network diagnostics
        {
          command = "/run/current-system/sw/bin/ss -tlnp";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/current-system/sw/bin/cat /proc/net/tcp";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];
}