{ config, ... }:

# sops-nix wiring for terra (desktop). Encrypted values in ../../secrets/terra.yaml,
# decrypted with terra's own SSH host key (recipient in ../../.sops.yaml).
# The host key is pre-generated on the laptop and shipped at install
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
{
  sops.defaultSopsFile = ../../secrets/terra.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  sops.secrets.tailscale_authkey = { };

  sops.secrets.darman_password.neededForUsers = true;
  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;

  # Credentials file for the //jupiter/data cifs mount (see configuration.nix).
  # samba_password mirrors jupiter's own samba_password secret (services/network/samba.nix) —
  # same value, just also encrypted to terra so it can authenticate as the same smb user.
  sops.secrets.samba_password = { };
  sops.templates."jupiter-smb.credentials".content = ''
    username=darman
    password=${config.sops.placeholder.samba_password}
  '';
}