fix(user): enforce declarative password management

Set mutableUsers = false to ensure password is managed declaratively via hashedPasswordFile. Updated password hash in SOPS secrets. Also adds nixos-config-researcher agent for Claude Code. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-30 19:06:07 -06:00
parent 83919d2367
commit 33d80a34bb
3 changed files with 108 additions and 16 deletions
@@ -1,17 +1,17 @@
-default_password: ENC[AES256_GCM,data:OIUc6YWvihJCbmE=,iv:I9di2h7TSfUYQf6+cYADDliOseHyzv8g8e3fKnj/Fsk=,tag:4jMnggF7zO9fGaggF9L20Q==,type:str]
-ssh_extra_config: ENC[AES256_GCM,data:ITG/R14Qs2UKHRYEmROQ5emYGlE6RtyV1+Oow+S7bGlnLFqK7WIqrrBz9mrl+BRw+XwVOBbjSSrh1jBO7PSqZPoPJsv3GiaGX2ZN9yQoaypcOCcEDW9hy0eatFV6ds4izka95otes18lizrjJGmeaK8zwk7XWGDcNPFFLBhslM71SckRotMTcYILTRnSxoFjEjHWss9F8WqxgDQgr03AR4jfXr5WbfjppNcbkQ==,iv:dAiggKGFgoTKDhf/5k1ijGKzHHVF98aCPxmwGTcg6ho=,tag:FywUb24JbvbJahUT3/6Bwg==,type:str]
+default_password: ENC[AES256_GCM,data:yaNWG/KWvXFjB461KnzpokeKzjupT3vxOdy33CsDDQc+cpRdP5FADyefW6bJg1V6pMfZUn1ktOlQNc5pgWrd1Vowy1XaOV/dSAgBruKi4LgLpT6vy6cevE2Q2Dv85/bxkeA/3uYeauFgnw==,iv:oiusW6KLveP9paNEJgrnGiJgb0wF2D7pRHVKE0s9w5c=,tag:EY/dS9XZdUDDx5colefyew==,type:str]
+ssh_extra_config: ENC[AES256_GCM,data:C2R05emTCmHgWSKzHGtUsO5ywyf2dcIoHVNIUnJpHKswD1izcmkIQnYP9HZ9eHFyU/1T+3oOolpLUCN2DH1LLrXM1Gzbh1VyIdT9ZBz/JHlqz4phfpFQCfTpZC9ppuE4FM/18U3BlGRrB92cK/j2g6/asDQAxs9rCpCG6d8xaf/TSCxI5njjp4LF0tcmi6vHuWoxQ3ydRoyWZH3DcOL1oXSYvBdkvbOqeEpxGw==,iv:BNe80hlbl+rVFH/kdC59VfjtGLjru+lOzL6y7PIEgKE=,tag:3dF3SDWGYDfM4OADWfKiuQ==,type:str]
 sops:
-  age:
-    - recipient: age1dhmt5tdyxd9zam542zkr9hq4tku7lzmf6j057sjtepk80deky5fqemczs5
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxdUJuSlIzZkR6dVJoTFlC
-        b3ozUXJzb3VETGZFck5OU2tMOERabWZVZHk0CnlhbEo4YTZ6bUZDcGlVbTIrSVZB
-        dm80d3hTK090cXd0L2tuWVFLa082aVkKLS0tIGFDWXdsd1lzb1Y0WlBNUEdEdFcx
-        L2Fuc3loREFSajloc3A3TFdnWkUrWG8Kxi0VTQ9NJY/tP2ItLLPQg1k63dWhtHqQ
-        K3H6T0f3rCWfxCP4ozVZf7weWJ9wS98zRkMPfHN2RzaeYGKzzaQ2Nw==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2025-12-30T23:58:01Z"
-  mac: ENC[AES256_GCM,data:wYxPlpnpxdimSMunqg8ht7sXM1F085wUH3aaVSLT136+fJfZRIKKzmHZPbqntDHdYTRJQ3Q5jvSSipjWAdwRzB4VRZgajnxht130RooNtLtodbIQMsfRAa4d7tBlfssYtDkaqZPlP8BUTYUE6kDoWJwR8zma0umRcEUmIpr34RM=,iv:3eRaFf/I1KlMWlVZR7x9U1SWrIQTKbeYVEIZZ2WcvkA=,tag:PI7eZL1YavttntM6b/ngiw==,type:str]
-  unencrypted_suffix: _unencrypted
-  version: 3.11.0
+    age:
+        - recipient: age1dhmt5tdyxd9zam542zkr9hq4tku7lzmf6j057sjtepk80deky5fqemczs5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZUdXQmJ5c05lT0swQUds
+            VmJiSTl2Nlh3YllyZEo1VU84Rm54UklQSFRjCk9BaFRzNWlDcWhLellmNzd6Sk92
+            NjdUc0N0RmNramFJZElpUlJxU3VueGsKLS0tIGtUWWNOR2xNRlhvUC91TElHQ0xn
+            K2cyS1M0VjhQTVVIeDAzdjhSQUFObDQKbikR2dS082J/MSnEp3CfYXRQNMUu/ezB
+            QRdV9KMbcEEhTLdoLXNz5OKyRlcjBDPTMk8PprQN4V6gP9Y/xltUOg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-31T00:18:55Z"
+    mac: ENC[AES256_GCM,data:5hNM3LwOiW6jJ/75UoEzet2ARl0pKvlOT5ipHuq1USLbUXhGxlvsi07PNRMRj9XkApizaezDD/Phx+ve0bMR8oLrCVaHoFksdq97qjx4bCDlO4nxugv0cyEDxUVsfSvI/lbdYIJ6poRxEhI+03RKrJiEpkVEUDqbvDkkTDG1nYg=,iv:4Orgh+sEriuhz8uwkoPZH5RlhvDzAhb20NrTgG/HEiA=,tag:u60ClCwHnow+dVVy7E3QDw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0