26ad576f - system

Authored by: Shota FUJI
Authored at: 2025-12-12 17:37:09 +0900
Committed by: Shota FUJI
Committed at: 2025-12-12 17:40:46 +0900
Signature: View
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE4gDBMFzisxhrQLxwXlFIlz4pE2MFAmk71ewACgkQXlFIlz4p E2Pm4BAAjd68q+hed+ZpuIUdfYkqi2uRa9Di07WAbVshl3XQrA5DtypkCmy5f9vM 7caNlj+Zk91khu3kA0B+gGoC6YhnwHcKQXPlkrD6K1MYAMSG3JrtgD4cQ3JBfE8B xZlhaYuqvHkPW+YsVHXLjJFtCq+QKyYK/DzpZHv7SLibbYhzNNcAV1SHl0f87a0E Lm+tLnE5wfE9RYkyfBT2zReEzmPAVp36TkJLJudsPlqDkwyG/s6AyS+umyvylnQe K3iv86QH/+uk/VrRS2d9d9V3GpWMgIB1QQ/dcGLgx/3BYHCUmpaMgvHn4wPA4uxz gkXv3/kKRGHieCKBa2LjbD9S2pxZ8Wmioae00N/idpP0Ty9fizvqMkPCgChXA+eA JKIL70d0VHw6i+SmAMEnYKhn9b4qaBnXKaPktZcvs+68h5ctOPN/xpXAGkZZqMrD XSPEY7t4mFxub8F++nilg2cZh2G53V2BA2Pp3mPGOyv2yCfhOTIrA0UV2FRWx50u /ZpM2Ay9o3VlDLThJ2/gCMnhSymkFVw1ADBs5L7XjPzx3amKZGdqwetHyYGlJhz2 t8Ipt6tTM+mVyUmMPyhrfGMjhxybPEbFZ5EPGLmr6cNwPWwjptY3Ps0UmFON5fqK K/PLWfoFlsR91J7NoadGwuzQbzZBjo/fTEVdgV5hfVNp9mSZ1fs= =C9df -----END PGP SIGNATURE-----
Object name: 26ad576feea6433a1fd2d2ca905c79a65f2e66d0
Parent: dd92e54d

Do not version control NixOS user password Target machine's public key is required for encrypting the password. However, getting the target machine's public key requires the user's password. root user's password configured at `nixos-install` will be wiped because of `mutableUsers = false`. So no way to login. Therefore `mutableUsers` has to be `true`, and if that option is enabled, I don't see any practical merits on committing encrypted password. If I set root password, why not set a normal user's password too?

Changes

2 changed files (+3/-14)

modules/nixos/profiles/queenbee.nix
- @@ -44,12 +44,10 @@
  networking.hostName = "hive"; - users.mutableUsers = false; users.users = { queenbee = { uid = 1000; isNormalUser = true; - hashedPasswordFile = config.age.secrets."queenbee/password".path; extraGroups = [ "wheel" "incus-admin"
- @@ -77,6 +75,8 @@
  home-manager.users.queenbee = ../../hm/profiles/nixos-desktop.nix; - age.secrets."queenbee/password".file = ../../../secrets/queenbee/password.age; + virtualisation.vmVariant = { + users.users.queenbee.initialPassword = "password"; + }; }; }
secrets/queenbee/password.age (deleted)
- @@ -1,11 +0,0 @@
  - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDljNGZ3USA1VGxt - dm1EWmpsRERLeUNEUmthcHlWcmcxUDZpY01Hdm5ZYjBFYnFCYjJrCmIveWpUM2Ri - TWNxbW8vZmV5M0Q1TVZuTlVrSkJsNzFFa2RvSFVZbHFnOHMKLT4gZD5PaC41aEIt - Z3JlYXNlIEtJOyBdTiBTIHZOMWM9aWApCks1d25Lc0N2c09lczdOWjFGMEd1K2hR - bzBDRTVabmNXWjZzR3BqL2liaDRxV2NIWDlEYysweG4wL2VRaDZ5YTcKcnlBcEpB - Ci0tLSBJSVd2N2k0VEwyM0lGd0FEVEtpTFVzRkNoN1VQUmtiUW1TbmlscnpzUUFr - CrvcQD2U7Y5QGmNE9ObYBFuVo/2Vos6Qs7E5ICAhwO9QWIC4/THtuq0TsA7Eh4Ff - aS8+TZRfDiN5S+MJO+x/RuzcSop3JUdOXNGT7qZgFAX7C9ikk/KHmWYgA1/cOC0X - G4EPww9iWpY6Lrw= - -----END AGE ENCRYPTED FILE-----