From c4938a6c056bee11800d0d10d1758f2d6015d9f5 Mon Sep 17 00:00:00 2001
From: Daniel Lindenfelser <daniel@lindenfelser.de>
Date: Thu, 19 Feb 2026 17:44:03 +0100
Subject: [PATCH] Remove plaintext secrets, update SSH key, and upgrade to
 NixOS 25.11

Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 Makefile               |  4 ++--
 flake.lock             | 27 ---------------------------
 flake.nix              |  2 +-
 modules/common.nix     |  4 ++--
 modules/fileserver.nix |  5 ++++-
 5 files changed, 9 insertions(+), 33 deletions(-)
 delete mode 100644 flake.lock

diff --git a/Makefile b/Makefile
index a1a61ea..ddf3315 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ help:
 	@echo "NixOS Infrastructure Management"
 	@echo ""
 	@echo "Targets:"
-	@echo "  make deploy                    Deploy to both gateway and fileserver"
+	@echo "  make deploy                    Deploy to gateway and fileserver"
 	@echo "  make deploy-gateway            Deploy to gateway only"
 	@echo "  make deploy-fileserver         Deploy to fileserver only"
 	@echo "  make deploy-k8s-server         Deploy to k8s-server only"
@@ -25,7 +25,7 @@ help:
 	@echo ""
 
 # Deployment targets
-deploy: deploy-gateway deploy-fileserver deploy-k8s-server
+deploy: deploy-gateway deploy-fileserver
 
 deploy-k8s-server:
 	@echo "======================================"
diff --git a/flake.lock b/flake.lock
deleted file mode 100644
index 95b6f09..0000000
--- a/flake.lock
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1762756533,
-        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flake.nix b/flake.nix
index f1b9f66..f2732bd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Home infra for lindenfelser.de (fileserver + gateway)";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   };
 
   outputs = { self, nixpkgs, ... }:
diff --git a/modules/common.nix b/modules/common.nix
index c39cace..ecc1369 100644
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -26,9 +26,9 @@
   users.users.danlin = {
     isNormalUser = true;
     extraGroups = [ "wheel" ];
-    initialPassword = "changeme";
+    hashedPassword = "$6$tvQ8UVAZIOm4g8PI$u1HBwK1xVINiNFOm.MtbvGsXb8R5SvBHqdJpTLcvDHJcdWa4GcB/R3txARlu.s/bLhtnwoKSKUksQ5ETwyQ5u.";
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+xf0lrobmWxml003CyjzEEZqUf2qbEv6vEGMGNUBAX danlin@MacBook-Pro-von-Daniel.fritz.box"
     ];
   };
 
diff --git a/modules/fileserver.nix b/modules/fileserver.nix
index 747c663..2ca1579 100644
--- a/modules/fileserver.nix
+++ b/modules/fileserver.nix
@@ -147,6 +147,9 @@
     "d /data/backup 0775 root root -"
     "d /data/backup/timemachine 0775 danlin users -"
     
+    # Secrets
+    "d /data/secrets 0700 root root -"
+
     # dj-beets project
     "d /opt/dj-beets 0755 root root -"
   ];
@@ -165,8 +168,8 @@
     volumes = [ "/data:/srv" ];
     environment = {
       TZ = "Europe/Berlin";
-      FILEBROWSER_ADMIN_PASSWORD = "CHANGE_ME";
     };
+    environmentFiles = [ "/data/secrets/filebrowser.env" ];
   };
 
   virtualisation.oci-containers.containers.gitea = {