From b0ad211a9268c1ce3cc38f5aed4ccec25d4831ed Mon Sep 17 00:00:00 2001
From: erik <erik.simon.me@gmail.com>
Date: Mon, 13 Jul 2026 22:53:43 +0200
Subject: [PATCH] fix(mercury): sops age key on root fs
 (/var/lib/sops-nix/age.txt)

Pi's vfat partition isn't mounted at runtime (u-boot reads it pre-boot), so
/boot/firmware doesn't exist -> keyFile moved to the always-mounted root fs.
deploy flash now drops it on the ext4 root partition.
---
 hosts/mercury/secrets.nix |  7 ++++---
 scripts/deploy            | 20 +++++++++++---------
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/hosts/mercury/secrets.nix b/hosts/mercury/secrets.nix
index 0ff90d6..10be8a7 100644
--- a/hosts/mercury/secrets.nix
+++ b/hosts/mercury/secrets.nix
@@ -3,12 +3,13 @@
 # sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
 #
 # SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
-# placed on the FAT boot partition. `./deploy flash mercury <dev>` does this
-# automatically (copies ~/.config/homelab/mercury/age.txt -> sops-age.txt).
+# placed on the ROOT filesystem (the Pi's vfat partition isn't mounted at
+# runtime — u-boot reads it pre-boot). `./deploy flash mercury <dev>` drops
+# ~/.config/homelab/mercury/age.txt there automatically.
 # The key never enters the repo, the nix store, or the image itself.
 {
   sops.defaultSopsFile = ../../secrets/mercury.yaml;
-  sops.age.keyFile = "/boot/firmware/sops-age.txt";
+  sops.age.keyFile = "/var/lib/sops-nix/age.txt";
 
   # darman's console password (SSH is key-only regardless). Different hash per
   # host = different password per host.
diff --git a/scripts/deploy b/scripts/deploy
index 978e69c..21dfa92 100755
--- a/scripts/deploy
+++ b/scripts/deploy
@@ -118,22 +118,24 @@ case "$cmd" in
     zstdcat "$img" | sudo dd of="$dev" bs=4M status=progress oflag=sync
     sync
 
-    # If this config has a dedicated sops age key, drop it on the FAT boot
-    # partition (mounts at /boot/firmware) so sops decrypts on first boot.
-    # Key stays off-repo and out of the nix store; the image itself has no key.
+    # If this config has a dedicated sops age key, drop it on the ROOT ext4
+    # partition at /var/lib/sops-nix/age.txt so sops decrypts on first boot.
+    # (The Pi's vfat partition isn't mounted at runtime, so the key can't live
+    # there.) Key stays off-repo, out of the nix store, and out of the image.
     keyfile="$HOME/.config/homelab/$config/age.txt"
     if [ -f "$keyfile" ]; then
-      echo ">> installing sops age key onto the boot partition"
+      echo ">> installing sops age key onto the root partition"
       sudo partprobe "$dev" 2>/dev/null || sudo blockdev --rereadpt "$dev" 2>/dev/null || true
       sudo udevadm settle 2>/dev/null || true
-      fatpart="$(lsblk -lno PATH,FSTYPE "$dev" | awk '$2=="vfat"{print $1; exit}')"
-      [ -n "$fatpart" ] || die "no FAT boot partition found on $dev — copy $keyfile to it manually as sops-age.txt"
+      # largest ext4 partition = the NixOS root.
+      rootpart="$(lsblk -blno PATH,FSTYPE,SIZE "$dev" | awk '$2=="ext4"{print $3, $1}' | sort -rn | head -1 | awk '{print $2}')"
+      [ -n "$rootpart" ] || die "no ext4 root partition found on $dev — place $keyfile at /var/lib/sops-nix/age.txt manually"
       mnt="$(mktemp -d)"
-      sudo mount "$fatpart" "$mnt"
-      sudo cp "$keyfile" "$mnt/sops-age.txt"
+      sudo mount "$rootpart" "$mnt"
+      sudo install -Dm600 "$keyfile" "$mnt/var/lib/sops-nix/age.txt"
       sudo sync
       sudo umount "$mnt"; rmdir "$mnt"
-      echo ">> age key installed (sops-age.txt)"
+      echo ">> age key installed (/var/lib/sops-nix/age.txt)"
     fi
     echo ">> done — insert the card into the Pi and boot."
     ;;