darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
22 lines
884 B
Nix
22 lines
884 B
Nix
{ config, ... }:
|
|
|
|
# sops-nix wiring for mercury. Encrypted values in ../../secrets/mercury.yaml.
|
|
#
|
|
# SD images get no `--extra-files` step, so mercury uses a dedicated age key
|
|
# on the root filesystem instead of the admin key — the Pi's vfat boot
|
|
# partition isn't mounted at runtime (u-boot reads it pre-boot), so the key
|
|
# can't live there.
|
|
{
|
|
sops.defaultSopsFile = ../../secrets/mercury.yaml;
|
|
sops.age.keyFile = "/var/lib/sops-nix/age.txt";
|
|
|
|
# darman's console password (SSH is key-only regardless). Different hash per
|
|
# host = different password per host.
|
|
sops.secrets.darman_password.neededForUsers = true;
|
|
users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
|
|
|
|
# Pre-auth key for services/vpn/tailscale.nix. Root-owned 0400 is right:
|
|
# tailscaled runs as root and reads authKeyFile itself.
|
|
sops.secrets.tailscale_authkey = { };
|
|
}
|