working on o001 to new flake modules, needed root fallback for secrets for root only system

flakes/secrets/flake.nix

@@ -26,11 +26,13 @@
                 secretsRaw = import ./secrets.nix;
                 systemName = config.networking.hostName;
                 # TODO revisit this slightly kinda scary method for choosing owners...
-                user = builtins.head (
+                user =
-                  builtins.filter (name: config.users.users.${name}.isNormalUser or false) (
+                  let
+                    normalUsers = builtins.filter (name: config.users.users.${name}.isNormalUser or false) (
                       builtins.attrNames config.users.users
-                  )
                     );
+                  in
+                  if normalUsers == [ ] then "root" else builtins.head normalUsers;
                 authorityMarker = "authority";
 
                 # Key matches this host if its trailing comment contains "@<host>"

hosts/linode/l001/flake.nix

@@ -4,9 +4,6 @@
     home-manager.url = "github:rycee/home-manager/release-25.05";
     deploy-rs.url = "github:serokell/deploy-rs";
 
-    # common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?rev=39edfefa5871d07c9f88ce92a55995eb347d9b09";
-    # common.inputs.home-manager.follows = "home-manager";
-
     # Use relative to get current version for testing
     # common.url = "path:../../flakes/common";
     common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";

hosts/oracle/o001/configuration.nix

@@ -4,6 +4,4 @@
   zramSwap.enable = false;
   networking.hostName = "o001";
   networking.domain = "subnet01171946.vcn01171946.oraclevcn.com";
-  services.openssh.enable = true;
-  system.stateVersion = "23.11";
 }

hosts/oracle/o001/flake.nix

@@ -1,25 +1,33 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+    home-manager.url = "github:rycee/home-manager/release-25.05";
     deploy-rs.url = "github:serokell/deploy-rs";
-
-    # common.url = "path:../../../common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
     ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
+
+    # Use relative to get current version for testing
+    # common.url = "path:../../../flakes/common";
+    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
+    secrets.url = "path:../../../flakes/secrets";
+    # secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
   };
 
   outputs =
     {
       self,
       nixpkgs,
+      home-manager,
       common,
+      secrets,
       ros_neovim,
       deploy-rs,
       ...
-    }:
+    }@inputs:
     let
       configuration_name = "o001";
       system = "aarch64-linux";
+      stateVersion = "23.11";
+      primaryUser = "root";
       lib = nixpkgs.lib;
     in
     {
@@ -40,11 +48,24 @@
       };
 
       nixosConfigurations = {
-        nixos = self.nixosConfigurations.${configuration_name};
+        "${configuration_name}" = (
-        "${configuration_name}" = lib.nixosSystem {
+          lib.nixosSystem {
             inherit system;
+            specialArgs = {
+              inherit inputs;
+            };
             modules = [
-            common.nixosModules.default
+              home-manager.nixosModules.default
+              secrets.nixosModules.default
+
+              common.nixosModules.essentials
+              common.nixosModules.git
+              common.nixosModules.hardening
+              common.nixosModules.nix_options
+              common.nixosModules.docker
+              common.nixosModules.tailnet
+              common.nixosModules.zsh
+
               ros_neovim.nixosModules.default
               ./configuration.nix
               ./hardware-configuration.nix
@@ -55,58 +76,51 @@
               ./mods/rustdesk-server.nix
               (
                 { pkgs, ... }:
-              {
+                rec {
-                environment.systemPackages = with pkgs; [
+                  # Home Manager
-                  bitwarden
+                  home-manager = {
-                  vaultwarden
+                    useUserPackages = true;
-                ];
+                    useGlobalPkgs = true;
+                    backupFileExtension = "bak";
+                    # add all normal users to home manager so it applies to them
+                    users = lib.mapAttrs (name: user: {
+                      home.stateVersion = stateVersion;
+                      programs.home-manager.enable = true;
+                    }) (lib.filterAttrs (name: user: name == "root" || (user.isNormalUser or false)) users.users);
 
-                ringofstorms_common = {
+                    sharedModules = [
-                  systemName = configuration_name;
+                      common.homeManagerModules.tmux
-                  secrets.enable = true;
+                      common.homeManagerModules.atuin
-                  general = {
+                      common.homeManagerModules.git
-                    disableRemoteBuildsOnLio = true;
+                      common.homeManagerModules.postgres_cli_options
-                    readWindowsDrives = false;
+                      common.homeManagerModules.starship
-                    jetbrainsMonoFont = false;
+                      common.homeManagerModules.zoxide
-                    ttyCapsEscape = false;
+                      common.homeManagerModules.zsh
-                    reporting.enable = true;
+                    ];
                   };
-                  programs = {
+
-                    tailnet.enable = true;
+                  # System configuration
-                    ssh.enable = true;
+                  system.stateVersion = stateVersion;
-                    docker.enable = true;
+                  networking.hostName = configuration_name;
-                  };
+                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
-                  users = {
+                  nixpkgs.config.allowUnfree = true;
-                    users = {
+                  users.users = {
-                      root = {
+                    "${primaryUser}" = {
+                      shell = pkgs.zsh;
                       openssh.authorizedKeys.keys = [
                         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG90Gg6dV3yhZ5+X40vICbeBwV9rfD39/8l9QSqluTw8 nix2oracle"
                       ];
-                        shell = pkgs.zsh;
                     };
                   };
-                  };
+
-                  homeManager = {
+                  environment.systemPackages = with pkgs; [
-                    users = {
+                    vaultwarden
-                      root = {
-                        programs.atuin.settings.sync_address = "http://localhost:8888";
-                        imports = with common.homeManagerModules; [
-                          tmux
-                          atuin
-                          git
-                          postgres
-                          starship
-                          zoxide
-                          zsh
                   ];
-                      };
-                    };
-                  };
-                };
                 }
               )
             ];
-        };
+          }
+        );
       };
     };
 }