{ config, ... }:

# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
#
# SD images have no `--extra-files` step, so mercury uses a DEDICATED age key
# (not ssh-host-key-derived) placed on the FAT boot partition after flashing:
#   mount the boot partition, copy ~/.config/homelab/mercury/age.txt to it as
#   sops-age.txt, unmount. The key never enters the repo or the nix store.
{
  sops.defaultSopsFile = ../../secrets/mercury.yaml;
  sops.age.keyFile = "/boot/firmware/sops-age.txt";

  # darman's console password (SSH is key-only regardless). Different hash per
  # host = different password per host.
  sops.secrets.darman_password.neededForUsers = true;
  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
}