userborn: init at 0.1.0

[nikstur]

Description of changes

This change introduces userborn to Nixpkgs.

Just like systemd-sysusers, it replaces the update-users-groups.pl script to achieve a perless system.

Userborn works mostly like sysusers but can fulfill some more of the requirements we have in NixOS.
Most notably, it can (1) also create normal users (with a UID >= 1000) and (2) change passwords and some other data about users. Please see the upstream readme for more information.

This might be the final big PR in the perlless series which included these PRs (and others!):
#270727
#328221
#328926

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[nikstur]

@ofborg build userborn

@ofborg test userborn
@ofborg test userborn-mutable-users userborn-immutable-users
@ofborg test userborn-mutable-etc userborn-immutable-etc

[r-vdp]

I tried this out on my machine, the users seem to get created correctly, but I got stuck on sops-nix not working, and important parts of my config rely on that.

I will see if I can find the time this week to look into adding support for this to sops-nix.

[nikstur]

I will see if I can find the time this week to look into adding support for this to sops-nix.

I think there already is logic to make this work in sops-nix with system-sysusers (probably gated behind systemd.sysusers.enable). Userborn right now is aliased to systemd-sysusers.service so if we just also enable whatever is done to make it work with sysusers, it should also just work with userborn.

cc @Mic92

[nyabinary]

Is systemd-homed in scope as well in the future?
Also, if this gets merged, wouldn't it be wised to move the repo to under the NixOS-org?

[r-vdp]

Is systemd-homed in scope as well in the future?

See #301337

Please use the search functionality and keep comments here on topic.

[nyabinary]

Is systemd-homed in scope as well in the future?

See #301337

Please use the search functionality and keep comments here on topic.

Not really off-topic when in #328926 Nikstur said this:
“I plan to add a perlless mode to add normal users via systemd-homed in the future.”
So I wonder what has happened to that plan since this seems like an alternative to using systemd-homed. Were there any roadblocks that made systemd-homed unfeasible?
IDK though I might be stupid and misunderstanding this pr?

[nikstur]

So I wonder what has happened to that plan since this seems like an alternative to using systemd-homed. Were there any roadblocks that made systemd-homed unfeasible?

It turns out that we cannot use systemd-homed declaratively at all. Using static User Record drop-ins via nss-system also doesn't work because there is no way for manually changing a password and UID/GID re-use is also unsolved this way. That's why I resorted to the last solution which is to write something myself.

wouldn't it be wised to move the repo to under the NixOS-org?

No, Userborn is a generic Linux tool, not necessarily only for NixOS. NixOS on the critical path also depends on other open source tools that are not in tree. I'm not aware of anyone even advocating that we should keep critical software in tree.

[aanderse]

the term "legacy" is problematic here and i am a bit surprised to find it used in our community in this context... we see how problematic this terminology has been with flakes

by using the term "legacy" we are misleading users and at best spreading confusion - we absolutely need to avoid the messaging of telling users they can choose the "legacy" option or the experimental option

please remove this term "legacy" and let's inform users they can continue with the solid current option that has years and years of battle hardened usage, or, they can work together with us to help introduce this new technology

thank you kindly for your consideration 🙇‍♂️

[nikstur]

@aanderse I removed all instances of the term "legacy". Please take another look.

[aanderse]

thanks very much @nikstur!

i took a look over the project and i am super excited about what you've made here

i think this is a good way forward! 🚀

[Mic92]

I will see if I can find the time this week to look into adding support for this to sops-nix.

I think there already is logic to make this work in sops-nix with system-sysusers (probably gated behind systemd.sysusers.enable). Userborn right now is aliased to systemd-sysusers.service so if we just also enable whatever is done to make it work with sysusers, it should also just work with userborn.

cc @Mic92

Yes. I can add the same logic for this variant as well.

[nikstur]

I've added a release note and an assertion that forbids to run both sysusers and Userborn at the same time. Most importantly, I do the latter because userborn is aliased to systemd-sysusers so we don't have to replicate all the dependencies.

If no one has an objection, I'll merge this soon because (a) it's completely opt-in and (b) to avoid release-note rebasing churn.

[WilliButz]

Great work! I tried this out on an existing workstation installation and it works just as I'd expect.
+1 to this being opt-in, I'll go ahead and merge

[Mic92]

Nice. Will test this soon in clan and nixos-images