Merge pull request 'fix(common): set mutableUsers = false to fix password setup on disk images' (#65) from worktree-warm-discovering-moon into main

Reviewed-on: #65

modules/common/configuration.nix

@@ -61,24 +61,32 @@
     !include ${config.sops.templates."nix-github-token.conf".path}
   '';
 
-  #Set root password
+  users = {
-  users.users.root = {
+    # With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
-    hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
+    # on every activation regardless of whether the account already exists in
-  };
+    # /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
+    # created accounts — which means a freshly-built proxmox disk image (where
+    # activation runs without a usable sops key, so both accounts land in shadow
+    # with ‘!’) will never have its passwords fixed by subsequent boots.
+    mutableUsers = false;
 
-  # Define a user account. Don't forget to set a password with ‘passwd’.
+    users.root = {
-  users.users.${vars.primaryUser} = {
+      hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
-    isNormalUser = true;
+    };
-    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+
-    packages = with pkgs; [
+    users.${vars.primaryUser} = {
-      tree
+      isNormalUser = true;
-    ];
+      extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-    hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
+      packages = with pkgs; [
-    openssh.authorizedKeys.keys = [
+        tree
-      vars.adminSshKey
+      ];
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+      hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
+      openssh.authorizedKeys.keys = [
-    ];
+        vars.adminSshKey
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
+      ];
+    };
   };