feat: per-host darman passwords via sops; mercury sops; AdGuard pw via UI

- per-host darman_password (distinct hash) in secrets/{jupiter,vps,mercury}.yaml -> hashedPasswordFile; different console password per host (ssh still key-only) - mercury: dedicated age key (on boot partition post-flash), sops-nix wired - AdGuard: module has no secret hook + writable config -> mutableSettings=true, admin password set via web setup on first boot (never in repo/store)
2026-07-13 20:52:06 +02:00
parent b989490333
commit 1937d59b2c
8 changed files with 78 additions and 24 deletions
@@ -55,6 +55,7 @@
          specialArgs = { inherit inputs; };
          modules = [
            (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+            sops-nix.nixosModules.sops
            ./hosts/mercury/configuration.nix
          ];
        };