me like nix
1{ config, ... }:
2
3{
4 # Pre-generated SSH host key for agenix decryption (shared across all Pis)
5 services.openssh.hostKeys = [
6 {
7 path = "/etc/ssh/ssh_host_ed25519_key";
8 type = "ed25519";
9 }
10 ];
11
12 environment.etc."ssh/ssh_host_ed25519_key" = {
13 source = /home/sean/nixos-config/secrets/pi_host_key;
14 mode = "0600";
15 };
16
17 # Agenix configuration - use Nix store path directly so the key is available
18 # before the etc activation script runs (agenix activates before etc)
19 age.identityPaths = [ "${/home/sean/nixos-config/secrets/pi_host_key}" ];
20 age.secrets.wifi = {
21 file = ../../secrets/wifi.age;
22 mode = "0444";
23 };
24
25 # WiFi configuration using wpa_supplicant with agenix credentials
26 networking.wireless = {
27 enable = true;
28 secretsFile = config.age.secrets.wifi.path;
29 networks."GL-MT6000-6a6".pskRaw = "ext:WIFI_PSK";
30 };
31}