modules/common/configuration.nix

@@ -61,13 +61,20 @@
     !include ${config.sops.templates."nix-github-token.conf".path}
   '';
 
-  #Set root password
-  users.users.root = {
+  users = {
+    # With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
+    # on every activation regardless of whether the account already exists in
+    # /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
+    # created accounts — which means a freshly-built proxmox disk image (where
+    # activation runs without a usable sops key, so both accounts land in shadow
+    # with ‘!’) will never have its passwords fixed by subsequent boots.
+    mutableUsers = false;
+
+    users.root = {
       hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
     };
 
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.${vars.primaryUser} = {
+    users.${vars.primaryUser} = {
       isNormalUser = true;
       extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
       packages = with pkgs; [
@@ -80,6 +87,7 @@
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
       ];
     };
+  };
 
 
   # Enable the OpenSSH daemon.