Use conditional identityFile in SSH host configs

flakes/secrets-bao/flake.nix

@@ -27,6 +27,35 @@
             ) secrets);
           in
           builtins.foldl' (acc: v: acc // v) { } fragments;
+
+        applyHmChanges = secrets:
+          let
+            substitute = secretPath: value:
+              if builtins.isAttrs value then
+                builtins.mapAttrs (_: v: substitute secretPath v) value
+              else if builtins.isList value then
+                map (v: substitute secretPath v) value
+              else if builtins.isString value then
+                builtins.replaceStrings [ "$SECRET_PATH" ] [ secretPath ] value
+              else
+                value;
+
+            fragments = builtins.attrValues (builtins.mapAttrs (
+              name: s:
+              let
+                secretPath = s.path or ("/run/secrets/" + name);
+              in
+              substitute secretPath (s.hmChanges or { })
+            ) secrets);
+
+            merged = builtins.foldl' (acc: v: acc // v) { } fragments;
+          in
+          if merged == { } then
+            { }
+          else
+            {
+              home-manager.sharedModules = [ (_: merged) ];
+            };
       };
 
       nixosModules = {