nixos/user: Load password from secret

nixos/boxes/colony/default.nix

@@ -135,7 +135,6 @@
           #deploy.generate.system.mode = "boot";
           secrets = {
             key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKp5WDdDr/1NS3SJIDOKwcCNZDFOxqPAD7cbZWAP7EkX";
-            files."test.txt" = {};
           };
 
           server.enable = true;

nixos/modules/user.nix

@@ -1,7 +1,7 @@
 { lib, options, config, ... }:
 let
-  inherit (lib) mkIf mkDefault mkOption mkAliasDefinitions;
-  inherit (lib.my) mkBoolOpt' mkDefault';
+  inherit (lib) mkIf mkDefault mkOption mkMerge mkAliasDefinitions;
+  inherit (lib.my) mkBoolOpt' mkOpt' mkDefault';
 
   cfg = config.my.user;
   user' = cfg.config;
@@ -10,6 +10,7 @@ in
 {
   options.my.user = with lib.types; {
     enable = mkBoolOpt' true "Whether to create a primary user.";
+    passwordSecret = mkOpt' (nullOr str) "user-passwd.txt" "Name of user password secret.";
     config = mkOption {
       type = options.users.users.type.nestedTypes.elemType;
       default = { };
@@ -24,7 +25,8 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable (mkMerge [
+    {
       my = {
         user = {
           config = {
@@ -32,7 +34,7 @@ in
             isNormalUser = true;
             uid = mkDefault 1000;
             extraGroups = mkDefault [ "wheel" "kvm" ];
-          password = mkDefault "hunter2"; # TODO: secrets...
+            password = mkIf (cfg.passwordSecret == null) (mkDefault "hunter2");
             shell =
               let shell = cfg.homeConfig.my.shell;
               in mkIf (shell != null) (mkDefault' shell);
@@ -84,5 +86,12 @@ in
       # NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
       # passed to it
       home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
-  };
+    }
+    (mkIf (cfg.passwordSecret != null) {
+      my = {
+        secrets.files."${cfg.passwordSecret}" = {};
+        user.config.passwordFile = config.age.secrets."${cfg.passwordSecret}".path;
+      };
+    })
+  ]);
 }

nixos/vms/estuary/default.nix

@@ -101,6 +101,7 @@
             };
 
             my = {
+              secrets.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhxM5mnguExkcLue47QKk1vA72OoPc3HOqqoHqHHfa1";
               server.enable = true;
 
               firewall = {

secrets/test.txt.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 SKXJUw cyFB+C3RIGQcLOO6MoKdM9B8lBBVdl9nYBlrF4XweGs
-CkmEZ6DzOW1TIWQxuKptpLTCGg8gzCp6UcHqhlXiuMY
--> X25519 Lbfpry55oE82Gb32mSypv/YIjIAZCazwbRpj2v2Htxs
-s0TfMT6DBevMaJlKk+hMBXgGh0B+2aGh7R8wx/lbjg0
--> @Q0Gc/-grease FQp^m
-O0cs1bBnmRtufx9GLavdRMh/hPPCDQ
---- 3hPsolp60qbM3svyL66dGoiAyW2ODOtFeBomBA5vLZc
-ôwZQyø$8ÆW•þ,R%´…ô\¶÷EŠeì`¶ý&ö0™4°½·©YKVæÓL<C393>y{Þo2í

secrets/user-passwd.txt.age

@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-ed25519 SKXJUw HNKr/VHMm2Tm3zXJy/hiWFT/HwMrs5dzi+JSdfe/3wE
+NH/28Nkeij6o3h63Fu/h2dgI8b6spZ0dMKp/yUfTCq4
+-> ssh-ed25519 B9K/XQ it45NurDEjYL5dAVJsJmi+MlIHKSpP2Lj7Fij5/ziUs
+1vKMO+h6aMAWDQDWwKrT0PwDhw90mk7x7uf27CCz27s
+-> ssh-ed25519 LLxJog aAmssC1kqweHP1TEtkVurusq1AqIc8t7HZ7A7hjRtAw
+lDbexbeib25DPuFiObs+1PQgu1WPG8a/P01QD6tO1f8
+-> X25519 lcKREBQdELTzOpxRXMJa5J9stI9u3tZJdAHGW2LC8W4
+7c+kF11czGa7DEq3+ZJW+iSLcU/XKn+YJlciQzLwP64
+-> y251}dI-grease
+zIIT0zZ1oHhvxwQtUM6JsvhIqbQ0fRz5YFJMrxkwk8FDwgIyoKHQhVWNYmFDWhEs
+K0QD0scV1HUGGAJdMoePqHw
+--- a2PYkwWrS0NFhoL/0IgmuvKRjkORQrotG+RKXVtXeiI
+t¦6þ©!<21>,ÞŸo.Ênœ7JßîK`ÝýaÑi.íŽc¶>$øWôä>"8»Ç<r4Y'{óæÏO"BÓð‘£yg
+P&Ñ
d|† ÌŠeê—"<22>ØTç<54>=î®ßÆeÍû§¶I(\‰Ælj½¢<SA³+즬-Ê´åé<C3A5>¶F^‘—