Remove plaintext secrets, update SSH key, and upgrade to NixOS 25.11

Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -12,7 +12,7 @@ help:
 	@echo "NixOS Infrastructure Management"
 	@echo ""
 	@echo "Targets:"
-	@echo "  make deploy                    Deploy to both gateway and fileserver"
+	@echo "  make deploy                    Deploy to gateway and fileserver"
 	@echo "  make deploy-gateway            Deploy to gateway only"
 	@echo "  make deploy-fileserver         Deploy to fileserver only"
 	@echo "  make deploy-k8s-server         Deploy to k8s-server only"
@@ -25,7 +25,7 @@ help:
 	@echo ""
 
 # Deployment targets
-deploy: deploy-gateway deploy-fileserver deploy-k8s-server
+deploy: deploy-gateway deploy-fileserver
 
 deploy-k8s-server:
 	@echo "======================================"

flake.lock

@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1762756533,
-        "narHash": "sha256-HiRDeUOD1VLklHeOmaKDzf+8Hb7vSWPVFcWwaTrpm+U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c2448301fb856e351aab33e64c33a3fc8bcf637d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -2,7 +2,7 @@
   description = "Home infra for lindenfelser.de (fileserver + gateway)";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   };
 
   outputs = { self, nixpkgs, ... }:

modules/common.nix

@@ -26,9 +26,9 @@
   users.users.danlin = {
     isNormalUser = true;
     extraGroups = [ "wheel" ];
-    initialPassword = "changeme";
+    hashedPassword = "$6$tvQ8UVAZIOm4g8PI$u1HBwK1xVINiNFOm.MtbvGsXb8R5SvBHqdJpTLcvDHJcdWa4GcB/R3txARlu.s/bLhtnwoKSKUksQ5ETwyQ5u.";
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+xf0lrobmWxml003CyjzEEZqUf2qbEv6vEGMGNUBAX danlin@MacBook-Pro-von-Daniel.fritz.box"
     ];
   };
 

modules/fileserver.nix

@@ -147,6 +147,9 @@
     "d /data/backup 0775 root root -"
     "d /data/backup/timemachine 0775 danlin users -"
     
+    # Secrets
+    "d /data/secrets 0700 root root -"
+
     # dj-beets project
     "d /opt/dj-beets 0755 root root -"
   ];
@@ -165,8 +168,8 @@
     volumes = [ "/data:/srv" ];
     environment = {
       TZ = "Europe/Berlin";
-      FILEBROWSER_ADMIN_PASSWORD = "CHANGE_ME";
     };
+    environmentFiles = [ "/data/secrets/filebrowser.env" ];
   };
 
   virtualisation.oci-containers.containers.gitea = {