From eac20f5e0a127588d9ffc79329e7d539692463ad Mon Sep 17 00:00:00 2001
From: Erik Simon <mail@erik-s.dev>
Date: Fri, 24 Jul 2026 00:34:12 +0200
Subject: [PATCH] terra: add proton-pass-cli via flake input

Not in nixpkgs; packaged by github:tomsch/proton-pass-cli-nix. Used by
./scripts/deploy to autofill sudo/ssh passwords from the "HomeLab" vault.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 flake.lock                    | 21 +++++++++++++++++++++
 flake.nix                     |  6 ++++++
 hosts/terra/configuration.nix |  7 ++++++-
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/flake.lock b/flake.lock
index 61a9167..ef043ed 100644
--- a/flake.lock
+++ b/flake.lock
@@ -295,6 +295,26 @@
         "type": "github"
       }
     },
+    "proton-pass-cli": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783676260,
+        "narHash": "sha256-J7yTLWLkhOOGT/YLyfgC3lEOCRTOXVK3h0UoKzhRels=",
+        "owner": "tomsch",
+        "repo": "proton-pass-cli-nix",
+        "rev": "1cad55698affce949d4cebacae31db448c17d9f1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tomsch",
+        "repo": "proton-pass-cli-nix",
+        "type": "github"
+      }
+    },
     "pyproject-build-systems": {
       "inputs": {
         "nixpkgs": [
@@ -404,6 +424,7 @@
         "nixos-images": "nixos-images",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "proton-pass-cli": "proton-pass-cli",
         "sops-nix": "sops-nix"
       }
     },
diff --git a/flake.nix b/flake.nix
index 99730ad..7841405 100644
--- a/flake.nix
+++ b/flake.nix
@@ -32,6 +32,12 @@
     # breaks their pinned python dependency set. Costs a second nixpkgs in the
     # lock; builds come prebuilt from nix-community's Cachix.
     authentik-nix.url = "github:nix-community/authentik-nix";
+    # Unofficial packaging of Proton's pass-cli (not in nixpkgs) — used by
+    # ./scripts/deploy to pull sudo/ssh passwords from the "HomeLab" vault.
+    proton-pass-cli = {
+      url = "github:tomsch/proton-pass-cli-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, disko, sops-nix, nixos-images, home-manager, mediamanager-nix, authentik-nix, ... }@inputs:
diff --git a/hosts/terra/configuration.nix b/hosts/terra/configuration.nix
index 862381c..2017dae 100644
--- a/hosts/terra/configuration.nix
+++ b/hosts/terra/configuration.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, inputs, ... }:
 
 # terra — Ryzen 9 5900X / Radeon RX 6800 XT desktop (MSI MS-7A32). Replaces
 # CachyOS on the OS SSD (Kingston SA400, sdb). Dev-data disks (sdc ext4
@@ -18,6 +18,11 @@
 
   networking.hostName = "terra";
 
+  # Proton Pass CLI — not in nixpkgs; ./scripts/deploy uses it to autofill
+  # sudo/ssh passwords from the "HomeLab" vault. Packaged by the
+  # proton-pass-cli flake input (github:tomsch/proton-pass-cli-nix).
+  environment.systemPackages = [ inputs.proton-pass-cli.packages.${pkgs.system}.default ];
+
   # ---- home-manager (user-level config for darman) ----
   home-manager.useGlobalPkgs = true;
   home-manager.useUserPackages = true;