Use age secrets on mineral machines (mainly for work-related tasks)

Signed-off-by: Mel <mel@rnrd.eu>

2 files changed, 10 insertions, 1 deletions

diff --git a/modules/common.nix b/modules/common.nix
index 66d48bb..45395a1 100644
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -92,6 +92,11 @@ in
     };
   };
 
+  # on desktop machines (a.k.a. minerals) we only use tailscale ssh
+  # for access, so we don't generally have normal host keys, and
+  # have to grab the ones tailscale uses.
+  age.identityPaths = [ "/var/lib/tailscale/ssh/ssh_host_ed25519_key" ];
+
   # TODO: the filter already does some good work, but we need some way to
   # pick out x86-only packages, so it is not as opaque as it currently is.
   # (who knows if muse-sounds-manager is actually installed, for example?)
diff --git a/modules/user.nix b/modules/user.nix
index 55985b6..5fd5dfa 100644
--- a/modules/user.nix
+++ b/modules/user.nix
@@ -1,13 +1,17 @@
 { config, pkgs, unstablePkgs, auxiliaryPkgs, ... }:
 
 {
+  age.secrets.password = {
+    file = ../secrets/password.age;
+  };
+
   users.mutableUsers = false;
   users.users.mel = {
     isNormalUser = true;
     description = "Mel";
     shell = pkgs.fish;
     extraGroups = [ "wheel" "dialout" "kvm" "networkmanager" "adbusers" ];
-    hashedPassword = "$y$j9T$4wGl.YJizIpcfFv0LyvLU0$7LLEkjIFWBOV.XXynReCOczBYNX0EZfMPIDB/bmmhhC";
+    hashedPasswordFile = config.age.secrets.password.path;
 
     # TODO: commented out pacckages are currently not available on ARM, and thus not on the
     # moissanite machine. filter them out in a better way.