From 1be8b3d8e8188b56b1cb3b9e6527ee4584629c03 Mon Sep 17 00:00:00 2001
From: luochen570 <1160510664@qq.com>
Date: Thu, 13 Aug 2026 04:17:18 +0800
Subject: [PATCH] security: comment out plaintext initialPassword

Temporary first-install shortcut kept as comment only;
avoid plaintext password landing in /nix/store (world-readable).
---
 .sops.yaml             | 2 +-
 modules/core/users.nix | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.sops.yaml b/.sops.yaml
index 274d677..41504d9 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -2,4 +2,4 @@ creation_rules:
   - path_regex: ^secrets/users/.*\.ya?ml$
     key_groups:
       - age:
-          - age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY
+          - age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY
diff --git a/modules/core/users.nix b/modules/core/users.nix
index e3414d6..73e2025 100644
--- a/modules/core/users.nix
+++ b/modules/core/users.nix
@@ -9,7 +9,9 @@
     shell = pkgs.zsh;
   }
   // lib.optionalAttrs (!(config.sops.secrets ? "users/luochen570/passwordHash")) {
-    initialPassword = "Dly928730@..";
+    # 安装新机时的临时密码快捷方式（明文仅用于首次安装，装完请改用 sops 哈希或移除）。
+    # 需要时解开注释使用；平时保持注释，避免明文进入 /nix/store。
+    # initialPassword = "Dly928730@..";
   }
   // lib.optionalAttrs (config.sops.secrets ? "users/luochen570/authorized_key") {
     openssh.authorizedKeys.keyFiles = [ config.sops.secrets."users/luochen570/authorized_key".path ];