working on o001 to new flake modules, needed root fallback for secrets for root only system

flakes/secrets/flake.nix

@@ -26,11 +26,13 @@
                 secretsRaw = import ./secrets.nix;
                 systemName = config.networking.hostName;
                 # TODO revisit this slightly kinda scary method for choosing owners...
-                user = builtins.head (
+                user =
-                  builtins.filter (name: config.users.users.${name}.isNormalUser or false) (
+                  let
-                    builtins.attrNames config.users.users
+                    normalUsers = builtins.filter (name: config.users.users.${name}.isNormalUser or false) (
-                  )
+                      builtins.attrNames config.users.users
-                );
+                    );
+                  in
+                  if normalUsers == [ ] then "root" else builtins.head normalUsers;
                 authorityMarker = "authority";
 
                 # Key matches this host if its trailing comment contains "@<host>"

hosts/linode/l001/flake.nix

@@ -4,9 +4,6 @@
     home-manager.url = "github:rycee/home-manager/release-25.05";
     deploy-rs.url = "github:serokell/deploy-rs";
 
-    # common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?rev=39edfefa5871d07c9f88ce92a55995eb347d9b09";
-    # common.inputs.home-manager.follows = "home-manager";
-
     # Use relative to get current version for testing
     # common.url = "path:../../flakes/common";
     common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";

hosts/oracle/o001/configuration.nix

@@ -4,6 +4,4 @@
   zramSwap.enable = false;
   networking.hostName = "o001";
   networking.domain = "subnet01171946.vcn01171946.oraclevcn.com";
-  services.openssh.enable = true;
-  system.stateVersion = "23.11";
 }

hosts/oracle/o001/flake.nix

@@ -1,25 +1,33 @@
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+    home-manager.url = "github:rycee/home-manager/release-25.05";
     deploy-rs.url = "github:serokell/deploy-rs";
-
-    # common.url = "path:../../../common";
-    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
     ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
+
+    # Use relative to get current version for testing
+    # common.url = "path:../../../flakes/common";
+    common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
+    secrets.url = "path:../../../flakes/secrets";
+    # secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
   };
 
   outputs =
     {
       self,
       nixpkgs,
+      home-manager,
       common,
+      secrets,
       ros_neovim,
       deploy-rs,
       ...
-    }:
+    }@inputs:
     let
       configuration_name = "o001";
       system = "aarch64-linux";
+      stateVersion = "23.11";
+      primaryUser = "root";
       lib = nixpkgs.lib;
     in
     {
@@ -40,73 +48,79 @@
       };
 
       nixosConfigurations = {
-        nixos = self.nixosConfigurations.${configuration_name};
+        "${configuration_name}" = (
-        "${configuration_name}" = lib.nixosSystem {
+          lib.nixosSystem {
-          inherit system;
+            inherit system;
-          modules = [
+            specialArgs = {
-            common.nixosModules.default
+              inherit inputs;
-            ros_neovim.nixosModules.default
+            };
-            ./configuration.nix
+            modules = [
-            ./hardware-configuration.nix
+              home-manager.nixosModules.default
-            ./nginx.nix
+              secrets.nixosModules.default
-            ./containers/vaultwarden.nix
-            ./mods/postgresql.nix
-            ./mods/atuin.nix
-            ./mods/rustdesk-server.nix
-            (
-              { pkgs, ... }:
-              {
-                environment.systemPackages = with pkgs; [
-                  bitwarden
-                  vaultwarden
-                ];
 
-                ringofstorms_common = {
+              common.nixosModules.essentials
-                  systemName = configuration_name;
+              common.nixosModules.git
-                  secrets.enable = true;
+              common.nixosModules.hardening
-                  general = {
+              common.nixosModules.nix_options
-                    disableRemoteBuildsOnLio = true;
+              common.nixosModules.docker
-                    readWindowsDrives = false;
+              common.nixosModules.tailnet
-                    jetbrainsMonoFont = false;
+              common.nixosModules.zsh
-                    ttyCapsEscape = false;
+
-                    reporting.enable = true;
+              ros_neovim.nixosModules.default
+              ./configuration.nix
+              ./hardware-configuration.nix
+              ./nginx.nix
+              ./containers/vaultwarden.nix
+              ./mods/postgresql.nix
+              ./mods/atuin.nix
+              ./mods/rustdesk-server.nix
+              (
+                { pkgs, ... }:
+                rec {
+                  # Home Manager
+                  home-manager = {
+                    useUserPackages = true;
+                    useGlobalPkgs = true;
+                    backupFileExtension = "bak";
+                    # add all normal users to home manager so it applies to them
+                    users = lib.mapAttrs (name: user: {
+                      home.stateVersion = stateVersion;
+                      programs.home-manager.enable = true;
+                    }) (lib.filterAttrs (name: user: name == "root" || (user.isNormalUser or false)) users.users);
+
+                    sharedModules = [
+                      common.homeManagerModules.tmux
+                      common.homeManagerModules.atuin
+                      common.homeManagerModules.git
+                      common.homeManagerModules.postgres_cli_options
+                      common.homeManagerModules.starship
+                      common.homeManagerModules.zoxide
+                      common.homeManagerModules.zsh
+                    ];
                   };
-                  programs = {
+
-                    tailnet.enable = true;
+                  # System configuration
-                    ssh.enable = true;
+                  system.stateVersion = stateVersion;
-                    docker.enable = true;
+                  networking.hostName = configuration_name;
-                  };
+                  programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
-                  users = {
+                  nixpkgs.config.allowUnfree = true;
-                    users = {
+                  users.users = {
-                      root = {
+                    "${primaryUser}" = {
-                        openssh.authorizedKeys.keys = [
+                      shell = pkgs.zsh;
-                          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG90Gg6dV3yhZ5+X40vICbeBwV9rfD39/8l9QSqluTw8 nix2oracle"
+                      openssh.authorizedKeys.keys = [
-                        ];
+                        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG90Gg6dV3yhZ5+X40vICbeBwV9rfD39/8l9QSqluTw8 nix2oracle"
-                        shell = pkgs.zsh;
+                      ];
-                      };
                     };
                   };
-                  homeManager = {
+
-                    users = {
+                  environment.systemPackages = with pkgs; [
-                      root = {
+                    vaultwarden
-                        programs.atuin.settings.sync_address = "http://localhost:8888";
+                  ];
-                        imports = with common.homeManagerModules; [
+                }
-                          tmux
+              )
-                          atuin
+            ];
-                          git
+          }
-                          postgres
+        );
-                          starship
-                          zoxide
-                          zsh
-                        ];
-                      };
-                    };
-                  };
-                };
-              }
-            )
-          ];
-        };
       };
     };
 }