luochen570/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: comment out plaintext initialPassword

Browse Source 
Temporary first-install shortcut kept as comment only;
avoid plaintext password landing in /nix/store (world-readable).
This commit is contained in:
luochen570
2026-08-13 04:17:18 +08:00
parent b2baaa5f5f
commit 1be8b3d8e8
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.sops.yaml
View File

@@ -2,4 +2,4 @@ creation_rules:
- path_regex: ^secrets/users/.*\.ya?ml$ - path_regex: ^secrets/users/.*\.ya?ml$
key_groups: key_groups:
- age: - age:
- age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY - age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY

4
modules/core/users.nix
View File

@@ -9,7 +9,9 @@
shell = pkgs.zsh; shell = pkgs.zsh;
} }
// lib.optionalAttrs (!(config.sops.secrets ? "users/luochen570/passwordHash")) { // lib.optionalAttrs (!(config.sops.secrets ? "users/luochen570/passwordHash")) {
initialPassword = "Dly928730@.."; # 安装新机时的临时密码快捷方式（明文仅用于首次安装，装完请改用 sops 哈希或移除）。
# 需要时解开注释使用；平时保持注释，避免明文进入 /nix/store。
# initialPassword = "Dly928730@..";
} }
// lib.optionalAttrs (config.sops.secrets ? "users/luochen570/authorized_key") { // lib.optionalAttrs (config.sops.secrets ? "users/luochen570/authorized_key") {
openssh.authorizedKeys.keyFiles = [ config.sops.secrets."users/luochen570/authorized_key".path ]; openssh.authorizedKeys.keyFiles = [ config.sops.secrets."users/luochen570/authorized_key".path ];