Hermes Agent
3e04ccc1e8
ai-worker only needs security audit commands, not deployment access. Removed: - nh os switch - nixos-rebuild switch Kept: - Firewall checks (iptables) - Fail2ban status - Log inspection (journalctl) - SSH config (sshd -T) - Docker service checks - Network diagnostics
82 lines
2.3 KiB
Nix
82 lines
2.3 KiB
Nix
{ pkgs, inputs, config, keys, ... }: {
|
|
users.users.ai-worker = {
|
|
isSystemUser = true;
|
|
group = "ai-worker";
|
|
home = "/home/ai-worker";
|
|
createHome = true;
|
|
extraGroups = [ "docker" ];
|
|
shell = pkgs.bashInteractive;
|
|
openssh.authorizedKeys.keys = [
|
|
keys.users.ai-worker.main
|
|
];
|
|
};
|
|
users.groups.ai-worker = {};
|
|
|
|
# Restricted sudo for ai-worker - security checks only
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ "ai-worker" ];
|
|
commands = [
|
|
# Firewall checks
|
|
{
|
|
command = "/run/wrappers/bin/sudo iptables -L -n -v";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/wrappers/bin/sudo iptables -S";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# Fail2ban status
|
|
{
|
|
command = "/run/current-system/sw/bin/fail2ban-client status";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/fail2ban-client status *";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/fail2ban-client get * banned";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# Log inspection
|
|
{
|
|
command = "/run/current-system/sw/bin/journalctl -t kernel -n 100";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/journalctl -u fail2ban -n 50";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/journalctl -u firewall -n 50";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# SSH config verification
|
|
{
|
|
command = "/run/current-system/sw/bin/sshd -T";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# Docker service checks
|
|
{
|
|
command = "/run/current-system/sw/bin/docker ps";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/docker inspect *";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# Network diagnostics
|
|
{
|
|
command = "/run/current-system/sw/bin/ss -tlnp";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/cat /proc/net/tcp";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
}
|