fix(common): set mutableUsers = false to fix password setup on disk images #65

Merged

beatzaplenty merged 1 commits from worktree-warm-discovering-moon into main

2026-07-25 21:37:35 +00:00

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	dfa5452af5	fix(common): set mutableUsers = false to fix password setup on disk images Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s Details When a proxmox-* disk image is built, activation runs during the image build without a valid sops age key (the SSH host key doesn't exist yet), so root and nixos land in /etc/shadow with locked '!' entries. With the default mutableUsers = true, update-users-groups.pl preserves existing shadow entries for accounts that already exist, so hashedPasswordFile is silently ignored on every subsequent boot — passwords are never fixed. Setting mutableUsers = false forces update-users-groups.pl to apply hashedPasswordFile unconditionally on every activation. On first real boot the sops-decrypted hash is now written regardless of whether the account already existed in shadow from the image build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uRcikkTp3D5VbXj2DwNpQ	2026-07-26 07:36:06 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

dfa5452af5

fix(common): set mutableUsers = false to fix password setup on disk images

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s

Details

When a proxmox-* disk image is built, activation runs during the image
build without a valid sops age key (the SSH host key doesn't exist yet),
so root and nixos land in /etc/shadow with locked '!' entries. With the
default mutableUsers = true, update-users-groups.pl preserves existing
shadow entries for accounts that already exist, so hashedPasswordFile is
silently ignored on every subsequent boot — passwords are never fixed.

Setting mutableUsers = false forces update-users-groups.pl to apply
hashedPasswordFile unconditionally on every activation. On first real
boot the sops-decrypted hash is now written regardless of whether the
account already existed in shadow from the image build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011uRcikkTp3D5VbXj2DwNpQ

2026-07-26 07:36:06 +10:00