all: initial bits for moving users passwords to the pw store

default.nix

@@ -60,9 +60,10 @@ in
   };
 
   config = {
-    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    sops = {
+      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
-    sops.secrets = {
+      secrets = {
         xin_secrets_deploy_key = {
           sopsFile = config.xin-secrets.deploy;
           owner = "root";
@@ -70,6 +71,8 @@ in
           mode = "400";
         };
       };
+    };
+
 
     security.pki.certificates = [
       ''

hosts/stan/default.nix

@@ -14,6 +14,7 @@ let
 
   userBase = {
     openssh.authorizedKeys.keys = pubKeys ++ config.myconf.managementPubKeys;
+    shell = pkgs.zsh;
   };
   peerixUser =
     if builtins.hasAttr "peerix" config.users.users
@@ -152,17 +153,26 @@ in
       owner = "root";
       mode = "400";
     };
+    abieber_hash = {
+      sopsFile = config.xin-secrets.user_passwords;
+      owner = "root";
+      mode = "400";
+      neededForUsers = true;
+    };
   };
 
-  users.users.root = userBase;
+  users = {
-  users.users.abieber =
+    mutableUsers = false;
-    {
+    users = {
+      root = userBase;
+      abieber = userBase // {
         isNormalUser = true;
         description = "Aaron Bieber";
-      shell = pkgs.zsh;
         extraGroups = [ "networkmanager" "wheel" "libvirtd" ];
-    }
+        hashedPasswordFile = config.sops.secrets.abieber_hash.path;
-    // userBase;
+      };
+    };
+  };
 
   nixpkgs.config.allowUnfree = true;
 

users/default.nix

@@ -25,14 +25,37 @@ in
   };
 
   config = mkIf config.defaultUsers.enable {
-    users.users.root = userBase;
+    sops = {
-    users.users.qbit =
+      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      userBase
+      secrets = {
-      // {
+        "${config.networking.hostName}_hash" = {
+          sopsFile = config.xin-secrets.root_passwords;
+          owner = "root";
+          mode = "400";
+          neededForUsers = true;
+        };
+        qbit_hash = {
+          sopsFile = config.xin-secrets.user_passwords;
+          owner = "root";
+          mode = "400";
+          neededForUsers = true;
+        };
+      };
+    };
+    users = {
+      mutableUsers = false;
+      users = {
+        root = userBase // {
+          hashedPasswordFile = config.sops.secrets."${config.networking.hostName}_hash".path;
+        };
+        qbit = userBase // {
           isNormalUser = true;
           description = "Aaron Bieber";
           home = "/home/qbit";
           extraGroups = [ "wheel" ];
+          hashedPasswordFile = config.sops.secrets.qbit_hash.path;
+        };
+      };
     };
 
     environment.systemPackages =