stuff

hosts/abacus/profiles.nix

@@ -1,3 +1,6 @@
 {
-  profiles.server.enable = true;
+  profiles = {
+    server.enable = true;
+    trusted.enable = true;
+  };
 }

hosts/abacus/static-sites.nix

@@ -1,5 +1,4 @@
 {
-  config,
   lib,
   ...
 }:
@@ -25,7 +24,7 @@ lib.mkMerge (
       };
 
       systemd.tmpfiles.settings."10-static-sites".${root}.d = {
-        user = config.users.mainUser;
+        user = "helvetica";
         group = "users";
         mode = "0755";
       };

hosts/abacus/users.nix

@@ -0,0 +1,13 @@
+{ config, inputs, ... }:
+{
+  age.secrets.user-helvetica.file = inputs.self + /secrets/users/helvetica.age;
+
+  users.users.helvetica = {
+    description = "Helvetica";
+    uid = 1000;
+    isNormalUser = true;
+    hashedPasswordFile = config.age.secrets.user-helvetica.path;
+    openssh.authorizedKeys.keys = builtins.attrValues config.pubkeys.users;
+    extraGroups = [ "wheel" ]; # TODO remove
+  };
+}