From dd6c4829adcb7a8a04cea17ccf4aaa68abc9bdf4 Mon Sep 17 00:00:00 2001
From: erik <erik.simon.me@gmail.com>
Date: Sun, 12 Jul 2026 21:22:00 +0200
Subject: [PATCH] feat: darman login password via sops (hashedPasswordFile)

- add darman_password (sha-512 hash) to secrets/jupiter.yaml
- neededForUsers so it lands in /run/secrets-for-users before user setup
- real host uses hashedPasswordFile; VM keeps its test initialPassword

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 jupiter/secrets.nix  |  9 ++++++++-
 secrets/jupiter.yaml | 27 ++++++++++++++-------------
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/jupiter/secrets.nix b/jupiter/secrets.nix
index 0ab31c2..2e4618e 100644
--- a/jupiter/secrets.nix
+++ b/jupiter/secrets.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 # sops-nix secret wiring (real host only; not imported by vm.nix).
 # Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to
@@ -15,4 +15,11 @@
 
   # Decrypts to /run/secrets/samba_password (root-only by default).
   sops.secrets.samba_password = { };
+
+  # darman's login password (a sha-512 hash, not plaintext — generate with
+  # `mkpasswd -m sha-512`, edit via ./edit_secrets). neededForUsers makes it
+  # available before user setup, at /run/secrets-for-users/darman_password.
+  sops.secrets.darman_password.neededForUsers = true;
+  users.users.darman.hashedPasswordFile =
+    config.sops.secrets.darman_password.path;
 }
diff --git a/secrets/jupiter.yaml b/secrets/jupiter.yaml
index a2b6179..d829a20 100644
--- a/secrets/jupiter.yaml
+++ b/secrets/jupiter.yaml
@@ -1,25 +1,26 @@
-samba_password: ENC[AES256_GCM,data:Ur5CuAlJhdw=,iv:po7oxygUqKS9yoJS8efQJe2mTr7e5zYkZjAVRgeoUB0=,tag:Mf0K3rIga5I4jnNU3glDyg==,type:str]
+samba_password: ENC[AES256_GCM,data:FhURTZTnYhQ=,iv:g21yQSwZv3Bo2iwZPsoCv/aISEQHN8gLL7DULJ++JTY=,tag:/msfpxx3R5j9s+8KI8JJbg==,type:str]
+darman_password: ENC[AES256_GCM,data:e0M2jZrdM7tJv8E6hRdlljX60m8hsQm4TfSVx9F6T/XWG2BY3GtoCHxYkNuYkYF2/zv3RrUzrm50zzkSo0bvHNUu1IJRs0lJENnZrnDaWdUABvVkzsmMITuzmrZw6ykgzks0sV44v9CnBg==,iv:mLcjjsYahrUvZfygcSkq4hwm5GedXJyJFeFtKhp9v4Y=,tag:KksJwOWzOGhjvdCKPG3EJw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKNTRmRDNFeitoYTU1djdV
-            N2lwbGdXb21kSFhPS2xoYXNaaitmV0IzdFJvCjFoc29JcE1pNVkzUXFrRVltK0RI
-            MXFleXFRT1NmZ0taQ0lMaUxNNC9QbWMKLS0tIFZUOGpZUVRTYVVRa21Na01rR0ow
-            YXV3K3c5TVpUS3VMZFdmLzZvSUxlWFkKKU7BpZzLcAvWdMnJAHJS2gOLeS/JeU9e
-            1TCQgbYeFg0YHHa3Z/Vg8Q64hSyhpYYkE46dsjgSiZfCKbH4JaEPKA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTDlIMSt0MU1oalJveFQ5
+            QVhhS2cxeFBRTEdLbXpsbGkvY3dkR3FCN1c4ClR6dklYemtlTDcwbkZEYU5CS2ty
+            UHJ6SXlyUDVVb2dnLzZrQjVYdVhleEUKLS0tIFJFckt0ZDJsOG14TUhadURBaDd1
+            bEkwUWlnSlVhVXpScFNybzhWQkVMMEEKvEggmrMSBY/Rf1b9pKqYiY+EXxUV10pE
+            71UqOrc1o9p5XaCoyJSMjQAyEeUjzDYCbAdCV6F4uhhvhjrDye/7HQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVWnFnYW8yZmhCZ05YdzVF
-            SS9OcHlrMkJVQmFMbWFqbXpjbEw5ZFhDbm5JClFIZGI0RmhvMTBtbVY1S20yRWFL
-            YysvYVBaZWtIV3NVUHpEeWxlUmIyTkEKLS0tIEZBVmdFTEJZM2k0NUtPSTFZZFd1
-            dWhWTGd6Rm5STHBveTlGcjdXbzhPYkUKAcwMaOR4nnOYOfQqH3tFnUp5QTEVsovb
-            p5+IspDbNPFgW4BDDb+l0mtU7+ulNG71lwySTs5aOEn3zh3vqXPR8w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNUp6d1l0ZXp6aGgzRDZw
+            MXdwKzNoU09ZWUxzOHVHZmxSOEYrQ0NsclVJCitXaXUrUlc1cHduU3dKMzFhLzdO
+            Q2ZXcDRBcUh5M3EyT2tDTjNjR0N6bVEKLS0tIC9Ybis4SkNvcXNiQ0Q0MEt3V1F4
+            aFNldCtPejFrUUc1bmxtSnJVSVorWjAKL6qjr8r27TTC3jGm14qxkXZ4dG/O5yNz
+            Bl0sZdxnncvjOaVb+q/9XNofRGkaYiAQUsuo7jJBI/MpfxHyPyz36A==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-12T18:10:45Z"
-    mac: ENC[AES256_GCM,data:ynQU/B5RvwGw1ILJJexrZWtzNr7z3IUyy86v8q0KhRsMH2qSHF0BK0Pzq/DcT3vru+MwKat1hJfO21Pdu+HRsqtzUZRViTCbjtz+vmnjwyQvBqBPhEtxDeBoTgd5RqjXxzcuOADfv0NkfvU9p06x8YF8AVYq9ONvOEZiC4MamoY=,iv:1Wm4JP5Djyc9jdExMBcSjWw/zF1EXexjjMhePOEWCt8=,tag:A51vbK8fpb8sg+eCLwbWmg==,type:str]
+    lastmodified: "2026-07-12T19:21:10Z"
+    mac: ENC[AES256_GCM,data:pTIUu386eCWjDvbAm9V2gQcxf+CDXIuKRmJpnrhzj2rSNGJ1uTfpb3VgD4YNMDQIXPVZG9hnL/D2k1htCdLckwemXrr5B8/Vk+f5F9B6uIIUgzhjib/SyME2klFqYABIOECNBjTqWlFZrJLtTm5VpOMNI1WiF5SoMcc9mvnb22A=,iv:uZzfZoG8qVSkJKEdkgH0Jrzhfhl2c81D5AzpdLHyHFY=,tag:qEh9/4eNuabzRbQo5NpWQA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1