neptun: record post-install hardware config, rotate darman's password

hardware-configuration.nix as regenerated by nixos-anywhere during the
install, replacing the placeholder. The detected initrd modules differ
from what the placeholder guessed (ata_piix, uhci_hcd), but the virtio
modules pinned in configuration.nix merge in regardless, so root mounts
either way.

darman_password is rotated because the previous hash's plaintext was not
recorded anywhere. Combined with wheelNeedsPassword = true and
PermitRootLogin = "no" that left no way to escalate on the box, and
recovery needed netcup's rescue system to edit /etc/shadow directly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/neptun/hardware-configuration.nix

@@ -1,23 +1,17 @@
-# PLACEHOLDER — replace on install.
-#
-# disko (disk-config.nix) owns the filesystems, so this file only carries
-# kernel modules + platform. nixos-anywhere regenerates it via:
-#   nixos-generate-config --no-filesystems
-# Keep the imports/kernel-module lines; the virtio modules are pinned in
-# configuration.nix so root mounts even if the generator misses them.
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_blk" "sr_mod" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  # NO fileSystems here — disko defines "/" and "/boot".
-
-  swapDevices = [ ];
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

secrets/neptun.yaml

@@ -1,4 +1,4 @@
-darman_password: ENC[AES256_GCM,data:otLevSn6bXBrjCu7Dv9PN7Umwrb7CD1PhC1i+J8rp2mURMYVuwF/ZnrlPC7/RDZgINIRBOXOkG9lZo3UjuRyqrtvfUzIm1jGL51l1zvZ/07oNW6OUp4IZEQpoOmz1GuXBlx+yKRQeRDHYA==,iv:pnwp3uAsBoiJdF+QV27h0jztgFJKrIqFlmMT7JkcHoA=,tag:Zb9ziCGsLQt+TcJRCv8tWA==,type:str]
+darman_password: ENC[AES256_GCM,data:7G2Hgh13TxI6ugw2ebp9UtLTQ7HRC/hrCga0FmZo8h8HjsR4sf3dq8esrKrWJG94aiMuNsayRpJRVXB1OTA8GotqzIff5Mfkn9q51hVGgIUaUQlWluPkw39oMWVfSNIHeHqQxWerw9mmaQ==,iv:erYSI1rZUk7HLMszf5wFmm5jey9npkAacYGNVMD9RCI=,tag:Rb6qLKEkemDybcv5abNExw==,type:str]
 authentik_secret_key: ENC[AES256_GCM,data:qLrAWBywlMqT6D3FYDqE9I/5Ep+zDVu9ns9TA4UVOBSQ1uFGEj01TU9norqPf12pi9/Qs32mVzm5BqDG259DxdGT9DZVQc03QVwiIQYtmWo=,iv:OVCIxIP1Xv+nHmYsrxaPgYWQiwzVPUe8pnbyMBVAuoI=,tag:+ywkwPqkY1Dkx1R5cUJ7PA==,type:str]
 authentik_bootstrap_email: ENC[AES256_GCM,data:OmqpKAiiFyS/rytnHYRZ,iv:VXiPV5VfduC/IW+E3gDlNAeE+hr+IZ9W7Ty6Npuu59Y=,tag:rjvTHnBxN/pMvpQC5W9S6Q==,type:str]
 authentik_bootstrap_password: ENC[AES256_GCM,data:QPCY0ni3jBQY5HyK+vRlyT4YTEo=,iv:41u1Jf+WYksPUY4pvKdHQA1RHW21GAfdVDRuQ7XtdYc=,tag:SYmzv26GbE1kwleXyKLG4Q==,type:str]
@@ -27,7 +27,7 @@ sops:
             Wptkf76aP9UpjhgNkxzedRebQPB7ti+UiVqCvLVimtuHcsm/NJPcRg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
-    lastmodified: "2026-07-20T05:25:30Z"
-    mac: ENC[AES256_GCM,data:QFdUgjejtbhY8APVQ4r6uenOK8t0+GC0hazQ2jKAPbxbS4RunkXVzAOBpdIt6woW6TU9FlAVyHFxMGlg6XDI6QgM4KtsSgRbYj06PVl+E2rwFH6lOBgOYtYTS50wXWiyOyqyPDAoHyke+8/R3Ri61XgpbD7DrUOFVhihVYTqf+Y=,iv:UcUZ2o/HiP/viXfM3fRiYRR2uI3rDFb6P2mggqDcAKk=,tag:1YhQAXn3DtE3vJxs1e+MoQ==,type:str]
+    lastmodified: "2026-07-20T07:03:51Z"
+    mac: ENC[AES256_GCM,data:jWjdbICvAycAGEkl7r1rdTNfr62Xn4re1pJZU+4IifGW67fSRE0SN99lXCTj1B+WmhchzqBCf42n5D4c5dgQXo51bvWttjayRsUaqA9Hk/5T7QvFdjiNWbXpKsku1qe7VhoxhqzVoNXy/l9LvJTWYTRTStg3RYEmX0XpmbPIsCU=,iv:qCHahmqoHve0bejlssie6kA8zAABkwHV8gBF5hD8ab0=,tag:4MvjJ33QrDRfd4vYK7V7iw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1