.gitignore

@@ -1,4 +1,3 @@
-secrets/
 dotfiles/zsh/.zcompdump
 dotfiles/nvim/lazy-lock.json
 result

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "secrets"]
+	path = secrets
+	url = git@git.caem.dev:caem/secrets

flake.nix

@@ -44,6 +44,9 @@
       inputs = inputs;
       user = "caem";
       modules = [
+        impermanence.nixosModules.impermanence
+        disko.nixosModules.disko
+        sops-nix.nixosModules.sops
         home-manager.nixosModules.home-manager {
           home-manager = {
             useGlobalPkgs = true;
@@ -53,10 +56,6 @@
             };
           };
         }
-
-        impermanence.nixosModules.impermanence
-        disko.nixosModules.disko
-        sops-nix.nixosModules.sops
       ];
     };
   };

modules/nixos/user/caem.nix

@@ -1,9 +1,15 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
+  sops.secrets.user_password = {
+    sopsFile = ../../../secrets/user_password.yaml;
+    neededForUsers = true;
+  };
+
   users.users.caem = {
     isNormalUser = true;
     shell = pkgs.zsh;
+    hashedPasswordFile = config.sops.secrets.user_password.path;
     extraGroups = [
       "wheel"
     ];

secrets

@@ -0,0 +1 @@
+Subproject commit 73908914ee288a689dede75c9e4ff1531e41159c