dotfiles/vmix.nix
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

windows/seal: per-VM account on the config medium, not baked

Browse source 
username/password move from the sealed image to makeConfigMedium, so two
VMs get distinct logins (and, as before, distinct SIDs). The sealed
image bakes only a generic bootstrap account ("vmixsetup") whose sole job
is to carry OOBE to a logon; post-oobe then creates the real account from
the config CD, switches autologon to it, and reboots so it builds its own
SID-bound profile on D:\Users\<username>. A one-shot cleanup (RunOnce,
first logon of the real account) retires the bootstrap and its profile
and applies the per-user tint. So nothing about the account is shared or
baked, and the on-disk profile folder matches the real username.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117qMyjpuXsjpVAcpJbFD8g
This commit is contained in:
Git Sagar 2026-09-18 09:24:04 -03:00
parent ee002586e5
commit 1510b6c5ff
3 changed files with 62 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/images/windows/helpers/makeConfigMedium.nix
View file

@ -20,6 +20,12 @@
{
name ? "vmix-config",
hostname ? "",
# The per-VM account. The sealed image carries a generic bootstrap account
# (only there to carry OOBE); on first boot this real account is created from
# here, gets the SID-bound profile on D:\Users\<username>, and the bootstrap
# is retired. Distinct per VM -- nothing about the account is shared/baked.
username ? "",
password ? "",
# { address; prefixLength; gateway; dns = [ ... ]; }
staticIP ? null,
timezone ? null,
@ -37,6 +43,8 @@ let
configPs1 = pkgs.writeText "vmix-config.ps1" ''
# vmix per-VM config -- generated, read by the sealed image's baked scripts.
$VmixHostname = '${hostname}'
${lib.optionalString (username != "") "$VmixUsername = '${username}'"}
${lib.optionalString (username != "") "$VmixPassword = '${password}'"}
${lib.optionalString (staticIP != null) ''
$VmixIpAddress = '${staticIP.address}'
$VmixPrefixLength = ${toString staticIP.prefixLength}