Fix sops user passwd

README.md

@@ -11,13 +11,14 @@ cp /mnt/etc/nixos/hardware-configuration.nix hosts/$(hostname)/hardware-configur
 rbw config set email admin@muon.host
 rbw config set base_url https://vault.muon.host
 rbw login
-sudo mkdir -p /mnt/home/muon/.config/sops/age
-sudo chown muon:users /mnt/home/muon/.config -R
-rbw get sops > /mnt/home/muon/.config/sops/age/keys.txt
+sudo mkdir -p /mnt/var/lib/sops-nix
+sudo chown muon:users /mnt/var/lib/sops-nix -R
+rbw get sops > /mnt/var/lib/sops-nix/key.txt
 sudo nixos-install --root /mnt --no-root-passwd --flake .#$(hostname)
 sudo mkdir -p /mnt/persist/{etc,var/lib/systemd}
 sudo cp -r {/mnt,/mnt/persist}/etc/nixos
 sudo cp -r {/mnt,/mnt/persist}/var/lib/nixos
+sudo cp -r {/mnt,/mnt/persist}/var/lib/sops-nix
 sudo cp -r {/mnt,/mnt/persist}/var/lib/systemd/coredump
 sudo cp {/mnt,/mnt/persist}/etc/machine-id
 ```

hosts/murk/configuration.nix

@@ -5,7 +5,6 @@ in {
   # Hardware
   imports = [
     ./hardware-configuration.nix
-    inputs.impermanence.nixosModules.impermanence
     "${
       builtins.fetchTarball {
         url =

modules/home/sops/default.nix

@@ -3,7 +3,7 @@ let cfg = config.mods;
 in with lib; {
   imports = [ inputs.sops-nix.homeManagerModules.sops ];
   sops = {
-    age.keyFile = "/home/muon/.config/sops/age/keys.txt";
+    age.keyFile = "/var/lib/sops-nix/key.txt";
     defaultSopsFile = ./secrets.yaml;
     secrets.zipline-auth = { };
   };

modules/nixos/impermanence.nix

@@ -4,8 +4,12 @@ with lib; {
 
   config = mkIf config.mods.impermanence.enable {
     environment.persistence."/persist" = {
-      directories =
-        [ "/var/lib/nixos" "/var/lib/systemd/coredump" "/etc/nixos" ];
+      directories = [
+        "/var/lib/nixos"
+        "/var/lib/systemd/coredump"
+        "/var/lib/sops-nix"
+        "/etc/nixos"
+      ];
       files = [ "/etc/machine-id" ];
     };
 

modules/nixos/sops/default.nix

@@ -3,9 +3,9 @@ let cfg = config.mods;
 in with lib; {
   imports = [ inputs.sops-nix.nixosModules.sops ];
   sops = {
-    age.keyFile = "/home/muon/.config/sops/age/keys.txt";
+    age.keyFile = "/var/lib/sops-nix/key.txt";
     defaultSopsFile = ./secrets.yaml;
-    secrets.muon-password = { };
+    secrets.muon-password.neededForUsers = true;
     secrets.zipline-secret = mkIf cfg.server.share.enable {
       owner = "zipline";
       group = "zipline";

utils.nix

@@ -8,6 +8,7 @@
         ./modules/nixos
         inputs.home-manager.nixosModules.default
         inputs.stylix.nixosModules.stylix
+        inputs.impermanence.nixosModules.impermanence
       ];
     };
 }