✨ [shared] Sops nix for user passwords

shared/modules/security/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./sops.nix
     ./yubikey.nix
   ];
 

shared/modules/security/sops.nix

@@ -0,0 +1,20 @@
+{
+  inputs,
+  lib,
+  systemConfig,
+  ...
+}:
+
+{
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  sops = {
+    defaultSopsFile = lib.custom.relativeToRoot "shared/secrets/secrets.yaml";
+    defaultSopsFormat = "yaml";
+
+    age.keyFile = "/home/${systemConfig.user.name}/.config/sops/age/keys.txt";
+    secrets.password.neededForUsers = true;
+  };
+}

shared/modules/users.nix

@@ -1,11 +1,11 @@
-{ systemConfig, ... }:
+{ config, systemConfig, ... }:
 let
   username = systemConfig.user.name;
 in
 {
-  # Define a user without a password, TODO pass in user.password
   users.users.${username} = {
     isNormalUser = true;
+    hashedPasswordFile = config.sops.secrets.password.path;
     description = username;
     extraGroups = [
       "networkmanager"