add mysql user to carp for makemysql (#353)

Author: jaysa68

hosts/servers/carp.nix

@@ -33,11 +33,6 @@
     public = true;
   };
 
-  # this should be in ocf utils package somehow
-  security.sudo.extraConfig = ''
-    ALL ALL=(mysql) NOPASSWD: /run/current-system/sw/bin/makemysql-real
-  '';
-
   age.secrets.makemysql-conf = {
     rekeyFile = ../../secrets/master-keyed/carp/makemysql.conf.age;
     path = "/opt/share/makeservices/makemysql.conf";

modules/login-server.nix

@@ -72,6 +72,19 @@ in
       ocf.auth.staffOnlySSH = false;
       ocf.ttyd.enable = true;
 
+      # makemysql-real runs as the mysql user for privilege separation
+      # TODO rewrite the makemysql script and see if theres a better way to do this?
+      # just carrying over what was done on our puppet host, tsunami
+      users.users.mysql = {
+        isSystemUser = true;
+        group = "mysql";
+      };
+      users.groups.mysql = { };
+
+      security.sudo.extraConfig = ''
+        ALL ALL=(mysql) NOPASSWD: /run/current-system/sw/bin/makemysql-real
+      '';
+
       security.pam.loginLimits = [
         {
           domain = "*";