Benjamin Diedrichsen
29 lines
1.2 KiB
JavaScript
29 lines
1.2 KiB
JavaScript
import { Manifest, uniqid } from '@bitsquare/nopy-cubes';
|
|
import { z } from 'zod';
|
|
|
|
export default Manifest({
|
|
id: 'user:add',
|
|
name: 'Add a user with fish shell and tools',
|
|
dependencies: () => ['apt:essentials'],
|
|
secrets: ['PASSWORD'],
|
|
schema: z.object({
|
|
USER: z
|
|
.string()
|
|
.describe('Username for the new user account')
|
|
.default(() => `user${uniqid(5)}`),
|
|
// A fixed placeholder, not a generated one: the password is never recorded
|
|
// in a session, so a generated default meant every run produced credentials
|
|
// nobody had seen and a replay produced different ones again.
|
|
PASSWORD: z.string().describe('Password for the new user account').default('changeme'),
|
|
GROUPS: z
|
|
.string()
|
|
.describe('Comma-separated list of additional groups (e.g., "docker,sudo")')
|
|
.default(''),
|
|
// No default on purpose. This used to carry a specific personal key, which
|
|
// meant an unattended run authorised someone else's key on the new account.
|
|
// Leaving it required makes `--use-defaults` refuse by name instead of
|
|
// guessing, and there is no key that would be a sensible guess.
|
|
PUBKEY: z.string().describe('SSH public key to authorize for the user'),
|
|
}),
|
|
});
|