.

users.nix

@@ -7,6 +7,7 @@
   imports = [
     ./home/user.nix
     ./home/root.nix
+    ./home/agents.nix
   ];
   sops.secrets."user/password" = {
     neededForUsers = true;
@@ -24,17 +25,41 @@
         homeMode = "700";
         hashedPasswordFile = config.sops.secrets."root/password".path;
       };
-      microvm = {
-        uid = 999;
-        isSystemUser = true;
-      };
-      # agent = {
+      # microvm = {
+      #   uid = 999;
+      #   isSystemUser = true;
+      # };
+      # work = {
       #   uid = 1001;
       #   homeMode = "770";
+      #   home = "/home/work";
+      #   isNormalUser = true;
+      #   shell = pkgs.fish;
+      #   group = "work";
+      #   extraGroups = [
+      #     "public"
+      #   ];
+      #   linger = true;
+      # };
+      agent = {
+        uid = 1002;
+        homeMode = "770";
+        home = "/home/agent";
+        shell = pkgs.fish;
+        isNormalUser = true;
+        group = "agent";
+        extraGroups = [ "public" ];
+        linger = true;
+      };
+      # sandbox = {
+      #   uid = 1003;
+      #   homeMode = "770";
+      #   home = "/home/sandbox";
       #   shell = pkgs.fish;
       #   isNormalUser = true;
-      #   group = "agents";
-      #   extraGroups = [ "user" ];
+      #   group = "sandbox";
+      #   extraGroups = [ "public" ];
+      #   linger = true;
       # };
       user = {
         uid = 1000;
@@ -47,14 +72,20 @@
           "libvirt"
           "systemd-journal"
           "kvm"
-          "agents"
+          "public"
+          "agent"
+          "sandbox"
+          # "work"
         ];
         hashedPasswordFile = config.sops.secrets."user/password".path;
+        linger = true;
       };
     };
     groups = {
       user.gid = 1000;
-      agents.gid = 777;
+      agent.gid = 1002;
+      public.gid = 777;
+      # sandbox.gid = 1003;
     };
   };
 }