feat: user admin mapping

flake.nix

@@ -10,27 +10,32 @@
 
   outputs = { self, nixpkgs, nixos-hardware, ... }:
   let
-    # Authorization keys for user mappings (login keys per user)
+    # Per-user mapping of auth (login) and sudo keys
-    auth_keys = {
+    key_mappings = {
-      alice = [
+      alice = {
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALiceKeyPlaceholder alice@host"
+        auth = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceAuthKeyPlaceholder alice@host"
         ];
-      bob = [
+        sudo = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobKeyPlaceholder bob@host"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceSudoKeyPlaceholder alice-admin@host"
         ];
       };
-
+      bob = {
-    # Sudo keys per user (keys granting sudo, applied to root)
+        auth = [
-    sudo_keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobAuthKeyPlaceholder bob@host"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAISudoKeyPlaceholder admin@host"
+        ];
+        sudo = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobSudoKeyPlaceholder bob-admin@host"
         ];
+      };
+    };
 
     sharedModules = [
       ./modules/users.nix
     ];
 
     sharedArgs = {
-      inherit auth_keys sudo_keys;
+      inherit key_mappings;
     };
   in {
     nixosConfigurations = {

modules/users.nix

@@ -1,6 +1,11 @@
-{ config, lib, pkgs, auth_keys, sudo_keys, ... }:
+{ config, lib, pkgs, key_mappings, ... }:
 
-{
+let
+  auth_keys = lib.mapAttrs (_: u: u.auth) key_mappings;
+  sudo_keys = lib.concatLists
+    (lib.attrValues
+      (lib.mapAttrs (_: u: u.sudo) key_mappings));
+in {
   users.users = {
     root.openssh.authorizedKeys.keys = sudo_keys;
   } // (lib.mapAttrs (name: keys: {