feat(mercury): pihole web password from sops via FTLCONF env override

pihole.toml is nix-managed read-only so 'pihole setpassword' fails. pihole-FTL
reads FTLCONF_* env vars (override the toml) — render an env file from the sops
secret pihole_webpassword and feed it via EnvironmentFile. Password stays out of
repo/store. VERIFIED in VM: FTLCONF_webserver_api_password -> API login works.

hosts/mercury/configuration.nix

@@ -24,11 +24,22 @@
   # VERIFY with `ip route` on the Pi — assuming the router is .1.
   networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };
   # Resolvers for the Pi's OWN lookups (not the LAN service). Kept public so the
-  # host resolves during boot without depending on its own AdGuard/unbound.
+  # host resolves during boot without depending on its own pihole/unbound.
   networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
-  # DNS adblock + DHCP (AdGuard) and the recursive resolver (unbound) come from
-  # the imported service modules. AdGuard forwards to unbound at 127.0.0.1:5335.
+  # DNS adblock + DHCP (pihole) and the recursive resolver (unbound) come from
+  # the imported service modules. pihole forwards to unbound at 127.0.0.1:5335.
+
+  # ---- pihole web admin password (from sops) ----
+  # pihole.toml is nix-managed read-only, so `pihole setpassword` can't write it.
+  # Instead pihole-FTL reads FTLCONF_* env vars (they override the toml). Render
+  # an env file from the sops secret and feed it to the service — password stays
+  # out of the repo and the nix store.
+  sops.secrets.pihole_webpassword = { };
+  sops.templates."pihole-ftl.env".content =
+    "FTLCONF_webserver_api_password=${config.sops.placeholder.pihole_webpassword}";
+  systemd.services.pihole-ftl.serviceConfig.EnvironmentFile =
+    config.sops.templates."pihole-ftl.env".path;
 
   # Do not modify after first flash.
   system.stateVersion = "26.05";

secrets/mercury.yaml

@@ -1,25 +1,26 @@
-darman_password: ENC[AES256_GCM,data:vlcmADPCvt3H+etrXeowGl8w5+RQj6vwPzrx0+3qXb2U7s22H7VN8oXSwnMHQh+lAacrnl1c8u4D3SOh22QQBIix1wgAMQTFN15fo1RE3bTAUtiaV4HKfPNEsM+brTQs4oaX2Pnl3kZAbQ==,iv:DSTreGrypTYm0fAf8k6YZ277XMKYrocwPUUG0IBs4Jg=,tag:GuujksyB01YuX3rp82Jz3Q==,type:str]
+darman_password: ENC[AES256_GCM,data:Wc7y/5QPUxD4mxDGBp9V2k6YNrbmehbpcltInIBSGk70cdqxSUOjHZIL0hzPS4ijrXPnR9gwSZbc7EmgbLZ2K96SJtz9+upDAQVVUFfNx0o+SfGEu3ai3Qi7tKa+1N9wZQW/+6gQOAMAGQ==,iv:K/GrcQFtYWgQAtDlNVaYS5jUADYfX6rMSIUM9niRcWQ=,tag:9dbiRlIzAkm382Bkc6LfJA==,type:str]
+pihole_webpassword: ENC[AES256_GCM,data:yTMUApkbGwa5SH7PRk8+,iv:Iev7y5T9igzMUUgo61X5fWRvqkKfC1hF7uj9U2FD7Vk=,tag:ym48IpvMjVRiqqMqTXxM+w==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMXdtQ2E3SENhY2RKWGx1
-            bWVPUUd6K2gwbnRjbjVZZnIvSkJpaW1kNXhNCmF5KzFZdDZoVjcybTIzeEltNk1X
-            QXg4bFJmQkhsUkVpQ1pEVHVUMmN2OWcKLS0tIExKdGwzWTJDbEd4b3V6SlIvSXo0
-            SDZMTXYyZThQamN1YUt2ODRhdm1kdEEK8wZbc4NCgWYJ4tZtq2UxATleAhJxor5b
-            H0Fjcz+V0CesaF1sxR1M1gUe7uXrhdNdNgZvr+aF/+jsKHq+thbelw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOQUdJRFBlYUYzWTFiaWJn
+            SS80UlJ0VWhhQmMzSWc3bkM3Q2NHNHJVT0ZFCmRDdnp5bzhCTHlTK2NseHRVc2Mw
+            OVl4QVdNclh5VXhoeGlsWXNLUkxUUE0KLS0tIE5jV1djL1FiTithVjZabTRHTzJ2
+            anR2d3V3TXA1L1RMcEtHZ0g3dTZ0dncKtzI9bsQEcuJb5PPuXMkNHOObdSmxxvWl
+            D3A1dJu2wnMV6TO5TNVAy9+jyp26RBkdkxoUqlChzBs0kl3/gmJNTA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNTJkd29HTWdFc1ZhTDFN
-            d2paTy91aGNNSlBWUDdqY255MzN1QUlibldJCmdHY0FVMU1uV2lRUGp0MjVFYjVO
-            RWNsMk0wU2oxaXdlS25TSHJIQnhxMXMKLS0tIG1GRjVSMEgyY2RYZDRSTllVd3g5
-            UGFjMERZTHhuWGpFVUE4TVIyYlA4WmMKcinqjjAaR3hJRLJepZPxunQz9WBvmP6+
-            ZsBrZS0j0B3MhTI+6gUWB82xozgmnh95w+SXSSZZvoss8RuicE5ysA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1UWhaT2tOdm02QWgyTkdB
+            Ry9XS0Q4U0dEdkhtbHZDVDNtcFRxcDhZOENrCkdmbjFvWUpzdnFEUTg3bjdXN3Rz
+            OXAxYUNGdDlxNjNaMlRZRjVFbDhVYjQKLS0tIHB0Z3RaOUJtZEVGTzlBSHRaQjBh
+            V0Yza1RVTmJTblBLZFkzZElwWTlmdncKCAiA6NdlpVJmuTbU1/rcTsB9UeGIQPlD
+            x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
-    lastmodified: "2026-07-13T18:55:42Z"
-    mac: ENC[AES256_GCM,data:dVDVsrqz10/EhNCqVRRTKo8tKNCBTU8ZLA7ASE7exWzzUVB1LPIw4ht4QV88cd7iMKy10UMnLUjyg7m0RTbTEJXzlMHjDUbJThNCZ+/oQyQbGlwvCV61KIwFWK3G1bO3Bz6ux+Lo7IG3a8pJIjntTFfb4+l1612QRd73XHp8wT4=,iv:8kyta/3+wXRnC05GmNbDz6IA/AEFSZl1VM4QF6C0Nxc=,tag:rQf5GUelRFZVmdXK4DjcBw==,type:str]
+    lastmodified: "2026-07-13T20:37:38Z"
+    mac: ENC[AES256_GCM,data:Ho1TYZnaF/Ke5e7OPc4oLnt3yVZPysvfK3hRZ3pxiA0uOw8USoNUSmfqXxhekwYxc2Lb0ZHrhvj7ntnWWFjeiJfRjSg4Y/6zr8i9z6506twH54HzIbcUHHx7joQKM6kmG2YHE/xCVoeXKOVxchqwgyuwofsK6O0k3MiGIBfLcDA=,iv:qQEucNPSeWZ5o9+aVmmfniLq336X8tQqWShpKr9dYUY=,tag:tdgv1Pi8/cmCo9tEHeTo2A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1