- Add installer/fresh-install.sh for installing from live ISO
- Handles disk partitioning, LUKS encryption, filesystem setup
- Generates minimal NixOS config for first boot
- Enable flakes in ISO environment
- Pass installer script content to ISO build via specialArgs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Phase 3: Encrypted secrets
- Add secrets module with agenix integration
- Create secrets/secrets.nix template for key definitions
- Installer generates SSH key if missing
- Installer creates personalized secrets.nix with user's key
- Full documentation in docs/SECRETS.md
Features:
- Secrets encrypted with age using SSH keys
- Decrypted automatically at system activation
- Safe to commit .age files to git
- Support for WiFi passwords, API keys, service credentials
Usage:
agenix -e secrets/my-secret.age
age.secrets.my-secret.file = ./secrets/my-secret.age;
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
