nixpkgs/system/users-groups.nix

{pkgs, config, upstartJobs, defaultShell}:

let ids = import ./ids.nix; in

rec {

  # User accounts to be created/updated by NixOS.
  users =
    let
      jobUsers = pkgs.lib.concatLists (map (job: job.users) upstartJobs.jobs);
      
      defaultUsers =
        [
          { name = "root";
            uid = ids.uids.root;
            description = "System administrator";
            home = "/root";
            shell = defaultShell;
            group = "root";
          }
          { name = "nobody";
            uid = ids.uids.nobody;
            description = "Unprivileged account (don't use!)";
          }
        ];
      
      makeNixBuildUser = nr:
        { name = "nixbld${toString nr}";
          description = "Nix build user ${toString nr}";
          uid = builtins.add ids.uids.nixbld nr;
          extraGroups = ["nixbld"];
        };
        
      nixBuildUsers = map makeNixBuildUser (pkgs.lib.range 1 10);
      
      addAttrs =
        { name
        , description
        , uid ? ""
        , group ? "nogroup"
        , extraGroups ? []
        , home ? "/var/empty"
        , shell ? (if useDefaultShell then defaultShell else "/noshell")
        , createHome ? false
        , useDefaultShell ? false
        }:
        { inherit name description uid group extraGroups home shell createHome; };

    in map addAttrs (defaultUsers ++ jobUsers ++ nixBuildUsers ++ config.users.extraUsers);


  # Groups to be created/updated by NixOS.
  groups =
    let
      jobGroups = pkgs.lib.concatLists (map (job: job.groups) upstartJobs.jobs);

      defaultGroups = 
        [
          { name = "root";
            gid = ids.gids.root;
          }
          { name = "wheel";
            gid = ids.gids.wheel;
          }
          { name = "nogroup";
            gid = ids.gids.nogroup;
          }
          { name = "users";
            gid = ids.gids.users;
          }
          { name = "nixbld";
            gid = ids.gids.nixbld;
          }
        ];

      addAttrs =
        { name, gid ? "" }:
        { inherit name gid; };

    in map addAttrs (defaultGroups ++ jobGroups ++ config.users.extraGroups);


  # Awful hackery necessary to pass the users/groups to the activation script.
  createUsersGroups = ../helpers/create-users-groups.sh;
  usersList = pkgs.writeText "users" (pkgs.lib.concatStrings (map (u: "${u.name}\n${u.description}\n${toString u.uid}\n${u.group}\n${toString (pkgs.lib.concatStringsSep "," u.extraGroups)}\n${u.home}\n${u.shell}\n${toString u.createHome}\n") users));
  groupsList = pkgs.writeText "groups" (pkgs.lib.concatStrings (map (g: "${g.name}\n${toString g.gid}\n") groups));
    
}