terra: add proton-pass-cli via flake input

Not in nixpkgs; packaged by github:tomsch/proton-pass-cli-nix. Used by
./scripts/deploy to autofill sudo/ssh passwords from the "HomeLab" vault.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.lock

@@ -295,6 +295,26 @@
         "type": "github"
       }
     },
+    "proton-pass-cli": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783676260,
+        "narHash": "sha256-J7yTLWLkhOOGT/YLyfgC3lEOCRTOXVK3h0UoKzhRels=",
+        "owner": "tomsch",
+        "repo": "proton-pass-cli-nix",
+        "rev": "1cad55698affce949d4cebacae31db448c17d9f1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tomsch",
+        "repo": "proton-pass-cli-nix",
+        "type": "github"
+      }
+    },
     "pyproject-build-systems": {
       "inputs": {
         "nixpkgs": [
@@ -404,6 +424,7 @@
         "nixos-images": "nixos-images",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "proton-pass-cli": "proton-pass-cli",
         "sops-nix": "sops-nix"
       }
     },

flake.nix

@@ -32,6 +32,12 @@
     # breaks their pinned python dependency set. Costs a second nixpkgs in the
     # lock; builds come prebuilt from nix-community's Cachix.
     authentik-nix.url = "github:nix-community/authentik-nix";
+    # Unofficial packaging of Proton's pass-cli (not in nixpkgs) — used by
+    # ./scripts/deploy to pull sudo/ssh passwords from the "HomeLab" vault.
+    proton-pass-cli = {
+      url = "github:tomsch/proton-pass-cli-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, disko, sops-nix, nixos-images, home-manager, mediamanager-nix, authentik-nix, ... }@inputs:

hosts/terra/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, inputs, ... }:
 
 # terra — Ryzen 9 5900X / Radeon RX 6800 XT desktop (MSI MS-7A32). Replaces
 # CachyOS on the OS SSD (Kingston SA400, sdb). Dev-data disks (sdc ext4
@@ -18,6 +18,11 @@
 
   networking.hostName = "terra";
 
+  # Proton Pass CLI — not in nixpkgs; ./scripts/deploy uses it to autofill
+  # sudo/ssh passwords from the "HomeLab" vault. Packaged by the
+  # proton-pass-cli flake input (github:tomsch/proton-pass-cli-nix).
+  environment.systemPackages = [ inputs.proton-pass-cli.packages.${pkgs.system}.default ];
+
   # ---- home-manager (user-level config for darman) ----
   home-manager.useGlobalPkgs = true;
   home-manager.useUserPackages = true;