Changes for lambda, fixes for sea.fudo.org

lib/fudo/users.nix

@@ -129,6 +129,34 @@ let
     let user-list = attrNames users;
     in filter (username: list-includes user-list username) group-members;
 
+  ensure-group-directory = group: dir: ''
+    if [[ -d ${dir} ]]; then
+      GROUP="$(stat --format '%G' "${dir}")"
+      if [[ "$GROUP" = "${group}" ]]; then
+        echo "${dir} exists and belongs to ${group}"
+        exit 0
+      else
+        echo "setting ownership of ${dir} to ${group}"
+        chgrp ${group} ${dir}
+        chmod g+rx ${dir}
+      fi
+    elif [[ ! -e ${dir} ]]; then
+      echo "creating ${dir} and setting ownership to ${group}"
+      mkdir ${dir}
+      chgrp ${group} ${dir}
+      chmod g+rx ${dir}
+    elif [[ -e ${dir} && ! -d ${dir} ]]; then
+      echo "unable to create directory ${dir}, object exists"
+      exit 2
+    else
+      echo "unknown error creating ${dir}"
+      exit 3
+    fi
+  '';
+
+  ensure-group-dirs-script = group: dirs:
+    concatStringsSep "\n" (map (ensure-group-directory group) dirs);
+
 in {
   options.fudo = {
     users = mkOption {
@@ -150,13 +178,10 @@ in {
     };
   };
 
-  imports = [
-    ./users-common.nix
-  ];
+  imports = [ ./users-common.nix ];
+
+  config = let sys = import ../system.nix { inherit lib config; };
 
-  config = let
-    sys = import ../system.nix { inherit lib config; };
-    
   in {
     fudo.auth.ldap-server = let
       ldapUsers = (filterAttrs
@@ -212,8 +237,23 @@ in {
       users = let
         home-manager-users =
           filterAttrs (username: userOpts: userOpts.home-manager-config != null)
-            sys.local-users;
-      in mapAttrs (username: userOpts: userOpts.home-manager-config) home-manager-users;
+          sys.local-users;
+      in mapAttrs (username: userOpts: userOpts.home-manager-config)
+      home-manager-users;
     };
+
+    # Group home directories have to exist, otherwise users can't log in
+    systemd.services = let
+      ensure-group-directories = group:
+        nameValuePair "ensure-group-directories-${group}" {
+          script = ensure-group-dirs-script group [ "/home/${group}" ];
+          wantedBy = [ "multi-user.target" ];
+          requires = [ "local-fs.target" ];
+          after = [ "remote-fs.target" ];
+        };
+      groups-with-members = attrNames
+        (filterAttrs (group: groupOpts: (length groupOpts.members) > 0)
+          sys.local-groups);
+    in listToAttrs (map ensure-group-directories groups-with-members);
   };
 }