fix: Fail the CI if formatting fails

.gitea/workflows/ci.yml

@@ -26,18 +26,23 @@ jobs:
   format-check:
     name: Format Check
     runs-on: [self-hosted, nix-builder]
+    timeout-minutes: 5
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Check formatting
+        timeout-minutes: 3
         run: |
-          nix fmt **/*.nix
-          if ! git diff --quiet; then
+          set -euo pipefail
+          echo "Checking code formatting..."
+          output=$(nix fmt **/*.nix 2>&1)
+          if [ -n "$output" ]; then
             echo "::error::Code is not formatted. Please run 'nix fmt **/*.nix' locally."
-            git diff
+            echo "$output"
             exit 1
           fi
+          echo "All files are properly formatted"
 
   eval-configs:
     name: Evaluate Key Configurations

flake.lock

@@ -239,6 +239,24 @@
       "inputs": {
         "systems": "systems_4"
       },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_5"
+      },
       "locked": {
         "lastModified": 1681202837,
         "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
@@ -636,6 +654,7 @@
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-old-kernel": "nixpkgs-old-kernel",
+        "usda-vision": "usda-vision",
         "vscode-server": "vscode-server"
       }
     },
@@ -720,6 +739,21 @@
         "type": "github"
       }
     },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -742,13 +776,34 @@
         "type": "github"
       }
     },
-    "vscode-server": {
+    "usda-vision": {
       "inputs": {
         "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
+      "locked": {
+        "lastModified": 1769814438,
+        "narHash": "sha256-DEZrmqpqbrd996W5p1r4GA1C8Jmo31n3N642ccS0deY=",
+        "ref": "refs/heads/main",
+        "rev": "78bfcf02612817a2cee1edbf92deeac9bf657613",
+        "revCount": 126,
+        "type": "git",
+        "url": "https://git.factory.uga.edu/MODEL/usda-vision.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.factory.uga.edu/MODEL/usda-vision.git"
+      }
+    },
+    "vscode-server": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
         "lastModified": 1753541826,
         "narHash": "sha256-foGgZu8+bCNIGeuDqQ84jNbmKZpd+JvnrL2WlyU4tuU=",

flake.nix

@@ -59,6 +59,12 @@
       url = "github:nix-community/NixOS-WSL/main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    # USDA Vision Dashboard application
+    usda-vision = {
+      url = "git+https://git.factory.uga.edu/MODEL/usda-vision.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =

fleet/boot.nix

@@ -5,9 +5,24 @@
 # - Bootloader configuration (systemd-boot with Plymouth)
 # - Timezone and locale settings
 # - Systemd sleep configuration
+#
+# Only applies to:
+# - Linux systems (not Darwin/macOS)
+# - Systems with actual boot hardware (not containers/WSL)
 
-{ lib, ... }:
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  # Check if this is a bootable system (not container, not WSL)
+  isBootable = !(config.boot.isContainer or false) && (pkgs.stdenv.isLinux);
+in
+{
+  config = lib.mkIf isBootable {
     boot = {
       loader.systemd-boot.enable = lib.mkDefault true;
       loader.efi.canTouchEfiVariables = lib.mkDefault true;
@@ -45,4 +60,5 @@
       SuspendState=freeze
       HibernateDelaySec=2h
     '';
+  };
 }

fleet/common.nix

@@ -7,16 +7,148 @@
 {
   config,
   lib,
+  inputs,
   ...
 }:
+let
+  # Import all hardware modules so they're available for enabling
+  hwTypes = import ../hw { inherit inputs; };
+  hwModules = lib.attrValues hwTypes;
+
+  # User account submodule definition
+  userSubmodule = lib.types.submodule {
+    options = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether this user account is enabled on this system.";
+      };
+      isNormalUser = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether this is a normal user account (vs system user).";
+      };
+      description = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Full name or description of the user (GECOS field).";
+        example = "John Doe";
+      };
+      extraGroups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Additional groups for the user (wheel, docker, etc.).";
+      };
+      hashedPassword = lib.mkOption {
+        type = lib.types.str;
+        default = "!";
+        description = "Hashed password for the user account. Default '!' means locked.";
+      };
+      extraPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = "Additional system packages available to this user.";
+      };
+      excludePackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = "System packages to exclude for this user.";
+      };
+      homePackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = "Packages to install in the user's home-manager profile.";
+      };
+      extraImports = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
+        default = [ ];
+        description = "Additional home-manager modules to import for this user.";
+      };
+      external = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.oneOf [
+            lib.types.path
+            (lib.types.submodule {
+              options = {
+                url = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Git repository URL to fetch user configuration from.";
+                };
+                rev = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Git commit hash, tag, or branch to fetch.";
+                };
+                submodules = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = "Whether to fetch Git submodules.";
+                };
+              };
+            })
+          ]
+        );
+        default = null;
+        description = "External dotfiles repository (user.nix + optional nixos.nix).";
+      };
+      opensshKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "SSH public keys for the user (authorized_keys).";
+      };
+      shell = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
+            "bash"
+            "zsh"
+            "fish"
+            "tcsh"
+          ]
+        );
+        default = "bash";
+        description = "Default shell for the user.";
+      };
+      editor = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
+            "vim"
+            "neovim"
+            "emacs"
+            "nano"
+            "code"
+          ]
+        );
+        default = "neovim";
+        description = "Default text editor for the user (sets EDITOR).";
+      };
+      useZshTheme = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to apply the system Zsh theme (Oh My Posh).";
+      };
+      useNvimPlugins = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to apply the system Neovim configuration.";
+      };
+    };
+  };
+in
 {
   imports = [
     ./fs.nix
     ./boot.nix
     ./user-config.nix
-    ./fleet-option.nix
     ../sw
-  ];
+    inputs.vscode-server.nixosModules.default
+    inputs.nixos-wsl.nixosModules.default
+  ]
+  ++ hwModules;
+
+  options.athenix.users = lib.mkOption {
+    type = lib.types.attrsOf userSubmodule;
+    default = { };
+    description = "User accounts configuration. Set enable=true for users that should exist on this system.";
+  };
 
   options.athenix = {
     forUser = lib.mkOption {

fleet/default.nix

@@ -20,8 +20,6 @@ let
   # Import fleet-option.nix (defines athenix.fleet) and inventory.nix (sets values)
   # We use a minimal module here to avoid circular dependencies from common.nix's imports
 
-  hostTypes = config.athenix.hwTypes;
-
   # Helper to create a single NixOS system configuration
   mkHost =
     {
@@ -123,11 +121,6 @@ let
         }
       ) userNixosModulePaths;
 
-      # Get the host type module from the hostTypes attribute set
-      typeModule =
-        hostTypes.${hostType}
-          or (throw "Host type '${hostType}' not found. Available types: ${lib.concatStringsSep ", " (lib.attrNames hostTypes)}");
-
       # External module from fetchGit/fetchurl
       externalPathModule =
         if externalModulePath != null then import externalModulePath { inherit inputs; } else { };
@@ -155,18 +148,27 @@ let
           ];
         };
 
+      # Hardware-specific external modules
+      hwSpecificModules =
+        lib.optional (hostType == "nix-lxc")
+          "${inputs.nixpkgs.legacyPackages.${system}.path}/nixos/modules/virtualisation/proxmox-lxc.nix";
+
       allModules =
         userNixosModules
         ++ [
           ./common.nix
-          typeModule
           overrideModule
           { networking.hostName = hostName; }
+          # Set athenix.host.name for secrets and other modules to use
+          { athenix.host.name = hostName; }
           {
             # Inject user definitions from flake-parts level
             config.athenix.users = lib.mapAttrs (_: user: lib.mapAttrs (_: lib.mkDefault) user) users;
           }
+          # Enable the appropriate hardware module based on hostType
+          { config.athenix.hw.${hostType}.enable = lib.mkDefault true; }
         ]
+        ++ hwSpecificModules
         ++ lib.optional (externalModulePath != null) externalPathModule;
     in
     {

fleet/fs.nix

@@ -4,12 +4,28 @@
 # This module defines:
 # - Disko partition layout (EFI, swap, root)
 # - Filesystem options (device, swap size)
+#
+# Only applies to systems with physical disk management needs
+# (not containers, not WSL, not systems without a configured device)
 
 { config, lib, ... }:
 
+let
+  cfg = config.athenix.host.filesystem;
+  # Only enable disk config if device is set and disko is enabled
+  hasDiskConfig = cfg.device != null && config.disko.enableConfig;
+in
 {
   options.athenix = {
-    host.filesystem = {
+    host = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Fleet-assigned hostname for this system.
+          Used for secrets discovery and other host-specific configurations.
+        '';
+      };
+      filesystem = {
         device = lib.mkOption {
           type = lib.types.nullOr lib.types.str;
           default = null;
@@ -48,15 +64,19 @@
         };
       };
     };
+  };
 
-  config = {
+  config = lib.mkMerge [
+    {
       # ========== Disk Partitioning (Disko) ==========
-    disko.enableConfig = lib.mkDefault (config.athenix.host.filesystem.device != null);
+      disko.enableConfig = lib.mkDefault (cfg.device != null);
+    }
 
+    (lib.mkIf hasDiskConfig {
       disko.devices = {
         disk.main = {
           type = "disk";
-        device = config.athenix.host.filesystem.device;
+          device = cfg.device;
           content = {
             type = "gpt";
             partitions = {
@@ -79,10 +99,10 @@
               };
 
               # Swap Partition (size configurable per host)
-            swap = lib.mkIf config.athenix.host.filesystem.useSwap {
+              swap = lib.mkIf cfg.useSwap {
                 name = "swap";
                 label = "swap";
-              size = config.athenix.host.filesystem.swapSize;
+                size = cfg.swapSize;
                 content = {
                   type = "swap";
                 };
@@ -107,5 +127,6 @@
           };
         };
       };
-  };
+    })
+  ];
 }

hw/nix-desktop.nix

@@ -10,11 +10,33 @@
   modulesPath,
   ...
 }:
+
+with lib;
+
+let
+  cfg = config.athenix.hw.nix-desktop;
+in
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
+  options.athenix.hw.nix-desktop = mkOption {
+    type = types.submodule {
+      options = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable desktop workstation hardware configuration.";
+        };
+      };
+    };
+    default = { };
+    description = "Desktop workstation hardware type configuration.";
+  };
+
+  config = mkIf cfg.enable {
+
     # ========== Boot Configuration ==========
 
     boot.initrd.availableKernelModules = [
@@ -47,4 +69,5 @@
     # ========== Software Profile ==========
     athenix.sw.enable = lib.mkDefault true;
     athenix.sw.desktop.enable = lib.mkDefault true;
+  };
 }

hw/nix-ephemeral.nix

@@ -11,11 +11,32 @@
   modulesPath,
   ...
 }:
+
+with lib;
+
+let
+  cfg = config.athenix.hw.nix-ephemeral;
+in
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
+  options.athenix.hw.nix-ephemeral = mkOption {
+    type = types.submodule {
+      options = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable ephemeral/diskless system hardware configuration.";
+        };
+      };
+    };
+    default = { };
+    description = "Ephemeral hardware type configuration.";
+  };
+
+  config = mkIf cfg.enable {
     # ========== Boot Configuration ==========
     boot.initrd.availableKernelModules = [
       "xhci_pci" # USB 3.0 support
@@ -63,4 +84,5 @@
 
     athenix.sw.enable = lib.mkDefault true;
     athenix.sw.stateless-kiosk.enable = lib.mkDefault true;
+  };
 }

hw/nix-laptop.nix

@@ -10,11 +10,32 @@
   modulesPath,
   ...
 }:
+
+with lib;
+
+let
+  cfg = config.athenix.hw.nix-laptop;
+in
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
+  options.athenix.hw.nix-laptop = mkOption {
+    type = types.submodule {
+      options = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable laptop hardware configuration with power management.";
+        };
+      };
+    };
+    default = { };
+    description = "Laptop hardware type configuration.";
+  };
+
+  config = mkIf cfg.enable {
     # ========== Boot Configuration ==========
 
     boot.initrd.availableKernelModules = [
@@ -60,4 +81,5 @@
 
     athenix.sw.enable = lib.mkDefault true;
     athenix.sw.desktop.enable = lib.mkDefault true;
+  };
 }

hw/nix-lxc.nix

@@ -5,17 +5,32 @@
 # Disables boot/disk management and enables remote development support.
 
 {
+  config,
   lib,
-  modulesPath,
-  inputs,
   ...
 }:
-{
-  imports = [
-    inputs.vscode-server.nixosModules.default
-    "${modulesPath}/virtualisation/proxmox-lxc.nix"
-  ];
 
+with lib;
+
+let
+  cfg = config.athenix.hw.nix-lxc;
+in
+{
+  options.athenix.hw.nix-lxc = mkOption {
+    type = types.submodule {
+      options = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable Proxmox LXC container hardware configuration.";
+        };
+      };
+    };
+    default = { };
+    description = "Proxmox LXC hardware type configuration.";
+  };
+
+  config = mkIf cfg.enable {
     # ========== Nix Configuration ==========
     nix.settings.trusted-users = [
       "root"
@@ -32,6 +47,9 @@
     disko.enableConfig = lib.mkForce false; # No disk management in container
     console.enable = true;
 
+    # Set timezone to fix /etc/localtime for Docker containers
+    time.timeZone = lib.mkDefault "America/New_York";
+
     # Allow getty to work in containers
     systemd.services."getty@".unitConfig.ConditionPathExists = [
       ""
@@ -57,4 +75,5 @@
 
     athenix.sw.enable = lib.mkDefault true;
     athenix.sw.headless.enable = lib.mkDefault true;
+  };
 }

hw/nix-surface.nix

@@ -12,7 +12,11 @@
   inputs,
   ...
 }:
+
+with lib;
+
 let
+  cfg = config.athenix.hw.nix-surface;
   # Use older kernel version for better Surface Go compatibility
   refSystem = inputs.nixpkgs-old-kernel.lib.nixosSystem {
     system = pkgs.stdenv.hostPlatform.system;
@@ -26,6 +30,21 @@ in
     inputs.nixos-hardware.nixosModules.microsoft-surface-go
   ];
 
+  options.athenix.hw.nix-surface = mkOption {
+    type = types.submodule {
+      options = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable Microsoft Surface tablet hardware configuration.";
+        };
+      };
+    };
+    default = { };
+    description = "Microsoft Surface hardware type configuration.";
+  };
+
+  config = mkIf cfg.enable {
     # ========== Boot Configuration ==========
 
     boot.initrd.availableKernelModules = [
@@ -66,4 +85,5 @@ in
     # ========== Software Profile ==========
     athenix.sw.enable = lib.mkDefault true;
     athenix.sw.tablet-kiosk.enable = lib.mkDefault true; # Touch-optimized kiosk mode
+  };
 }

hw/nix-wsl.nix

@@ -7,16 +7,30 @@
 {
   lib,
   config,
-  inputs,
   ...
 }:
-{
-  imports = [
-    inputs.nixos-wsl.nixosModules.default
-    inputs.vscode-server.nixosModules.default
-  ];
 
-  # ========== Options ==========
+with lib;
+
+let
+  cfg = config.athenix.hw.nix-wsl;
+in
+{
+  options.athenix.hw.nix-wsl = mkOption {
+    type = types.submodule {
+      options = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable Windows Subsystem for Linux hardware configuration.";
+        };
+      };
+    };
+    default = { };
+    description = "WSL hardware type configuration.";
+  };
+
+  # WSL user option (at module level, not inside config)
   options.athenix.host.wsl.user = lib.mkOption {
     type = lib.types.str;
     default = "engr-ugaif";
@@ -29,7 +43,7 @@
     example = "alice";
   };
 
-  config = {
+  config = mkIf cfg.enable {
     # ========== WSL Configuration ==========
     wsl.enable = true;
     # Use forUser if set, otherwise fall back to wsl.user option
@@ -55,5 +69,8 @@
     # Provide dummy values for required options from boot.nix
     athenix.host.filesystem.device = "/dev/null";
     athenix.host.filesystem.swapSize = "0G";
+
+    # WSL doesn't use installer ISOs
+    athenix.host.buildMethods = lib.mkDefault [ ];
   };
 }

hw/nix-zima.nix

@@ -10,11 +10,32 @@
   modulesPath,
   ...
 }:
+
+with lib;
+
+let
+  cfg = config.athenix.hw.nix-zima;
+in
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
+  options.athenix.hw.nix-zima = mkOption {
+    type = types.submodule {
+      options = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable Zima-specific hardware configuration.";
+        };
+      };
+    };
+    default = { };
+    description = "Zima hardware type configuration.";
+  };
+
+  config = mkIf cfg.enable {
     # ========== Boot Configuration ==========
 
     boot.initrd.availableKernelModules = [
@@ -46,4 +67,5 @@
     # ========== Software Profile ==========
     athenix.sw.enable = lib.mkDefault true;
     athenix.sw.desktop.enable = lib.mkDefault true;
+  };
 }

inventory.nix

@@ -129,8 +129,8 @@
         };
         "usda-dash".external = {
           url = "https://git.factory.uga.edu/MODEL/usda-dash-config.git";
-          rev = "dab32f5884895cead0fae28cb7d88d17951d0c12";
-          submodules = true;
+          rev = "ce2700b0196e106f7c013bbcee851a5f96b146a3";
+          submodules = false;
         };
       };
       overrides = {

lib/default.nix

@@ -1,4 +1,8 @@
-{ ... }:
+{
+  lib,
+  ...
+}:
 {
   mkFleet = import ./mkFleet.nix;
+  macCaseBuilder = import ./macCaseBuilder.nix { inherit lib; };
 }

lib/macCaseBuilder.nix

@@ -0,0 +1,33 @@
+{ lib }:
+let
+  # Default MAC address to station number mapping
+  defaultHostmap = {
+    "00:e0:4c:46:0b:32" = "1";
+    "00:e0:4c:46:07:26" = "2";
+    "00:e0:4c:46:05:94" = "3";
+    "00:e0:4c:46:07:11" = "4";
+    "00:e0:4c:46:08:02" = "5";
+    "00:e0:4c:46:08:5c" = "6";
+  };
+
+  # macCaseBuilder: builds a shell case statement from a hostmap
+  # Parameters:
+  #   varName: the shell variable to assign
+  #   prefix: optional string to prepend to the value (default: "")
+  #   hostmap: optional attribute set to use (default: built-in hostmap)
+  #
+  # Example:
+  #   macCaseBuilder { varName = "STATION"; prefix = "nix-"; }
+  #   # Generates case statements like: 00:e0:4c:46:0b:32) STATION=nix-1 ;;
+  builder =
+    {
+      varName,
+      prefix ? "",
+      hostmap ? defaultHostmap,
+    }:
+    lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (mac: val: "      ${mac}) ${varName}=${prefix}${val} ;;") hostmap
+    );
+in
+# Export the builder function with hostmap as an accessible attribute
+lib.setFunctionArgs builder { } // { hostmap = defaultHostmap; }

parts/lib.nix

@@ -1,5 +1,8 @@
 # Library functions for flake-parts
 { inputs, ... }:
 {
-  flake.lib = import ../lib { inherit inputs; };
+  flake.lib = import ../lib {
+    inherit inputs;
+    lib = inputs.nixpkgs.lib;
+  };
 }

secrets.nix

@@ -0,0 +1,187 @@
+# ============================================================================
+# Agenix Secret Recipients Configuration (Auto-Generated)
+# ============================================================================
+# This file automatically discovers hosts and their public keys from the
+# secrets/ directory structure and generates recipient configurations.
+#
+# Directory structure:
+#   secrets/{hostname}/*.pub  -> SSH/age public keys for that host
+#   secrets/global/*.pub      -> Keys accessible to all hosts
+#
+# Usage:
+#   ragenix -e secrets/global/example.age     # Edit/create secret
+#   ragenix -r                                # Re-key all secrets
+#
+# To add admin keys for editing secrets, create secrets/admins/*.pub files
+# with your personal age public keys (generated with: age-keygen)
+
+let
+  lib = builtins;
+
+  # Helper functions not in builtins
+  filterAttrs =
+    pred: set:
+    lib.listToAttrs (
+      lib.filter (item: pred item.name item.value) (
+        lib.map (name: {
+          inherit name;
+          value = set.${name};
+        }) (lib.attrNames set)
+      )
+    );
+
+  concatLists = lists: lib.foldl' (acc: list: acc ++ list) [ ] lists;
+
+  unique =
+    list:
+    let
+      go =
+        acc: remaining:
+        if remaining == [ ] then
+          acc
+        else if lib.elem (lib.head remaining) acc then
+          go acc (lib.tail remaining)
+        else
+          go (acc ++ [ (lib.head remaining) ]) (lib.tail remaining);
+    in
+    go [ ] list;
+
+  hasSuffix =
+    suffix: str:
+    let
+      lenStr = lib.stringLength str;
+      lenSuffix = lib.stringLength suffix;
+    in
+    lenStr >= lenSuffix && lib.substring (lenStr - lenSuffix) lenSuffix str == suffix;
+
+  nameValuePair = name: value: { inherit name value; };
+
+  secretsPath = ./secrets;
+
+  # Read all directories in secrets/
+  secretDirs = if lib.pathExists secretsPath then lib.readDir secretsPath else { };
+
+  # Filter to only directories (excludes files)
+  isDirectory = name: type: type == "directory";
+  directories = lib.filter (name: isDirectory name secretDirs.${name}) (lib.attrNames secretDirs);
+
+  # Read public keys from a directory and convert to age format
+  readHostKeys =
+    dirName:
+    let
+      dirPath = secretsPath + "/${dirName}";
+      files = if lib.pathExists dirPath then lib.readDir dirPath else { };
+
+      # Prefer .age.pub files (pre-converted), fall back to .pub files
+      agePubFiles = filterAttrs (name: type: type == "regular" && hasSuffix ".age.pub" name) files;
+
+      sshPubFiles = filterAttrs (
+        name: type: type == "regular" && hasSuffix ".pub" name && !(hasSuffix ".age.pub" name)
+      ) files;
+
+      # Read age public keys (already in correct format)
+      ageKeys = lib.map (
+        name:
+        let
+          content = lib.readFile (dirPath + "/${name}");
+          # Trim whitespace/newlines
+          trimmed = lib.replaceStrings [ "\n" " " "\r" "\t" ] [ "" "" "" "" ] content;
+        in
+        trimmed
+      ) (lib.attrNames agePubFiles);
+
+      # For SSH keys, just include them as-is (user needs to convert with ssh-to-age)
+      # Or they can run the update-age-keys.sh script
+      sshKeys =
+        if (lib.length (lib.attrNames sshPubFiles)) > 0 then
+          lib.trace "Warning: ${dirName} has unconverted SSH keys. Run secrets/update-age-keys.sh" [ ]
+        else
+          [ ];
+    in
+    lib.filter (k: k != null && k != "") (ageKeys ++ sshKeys);
+
+  # Build host key mappings: { hostname = [ "age1..." "age2..." ]; }
+  hostKeys = lib.listToAttrs (
+    lib.map (dir: nameValuePair dir (readHostKeys dir)) (
+      lib.filter (d: d != "global" && d != "admins") directories
+    )
+  );
+
+  # Global keys that all hosts can use
+  globalKeys = if lib.elem "global" directories then readHostKeys "global" else [ ];
+
+  # Admin keys for editing secrets
+  adminKeys = if lib.elem "admins" directories then readHostKeys "admins" else [ ];
+
+  # All host keys combined
+  allHostKeys = concatLists (lib.attrValues hostKeys);
+
+  # Find all .age files in the secrets directory
+  findSecrets =
+    dir:
+    let
+      dirPath = secretsPath + "/${dir}";
+      files = if lib.pathExists dirPath then lib.readDir dirPath else { };
+      ageFiles = filterAttrs (name: type: type == "regular" && hasSuffix ".age" name) files;
+    in
+    lib.map (name: "secrets/${dir}/${name}") (lib.attrNames ageFiles);
+
+  # Generate recipient list for a secret based on its location
+  getRecipients =
+    secretPath:
+    let
+      # Extract directory name from path: "secrets/nix-builder/foo.age" -> "nix-builder"
+      pathParts = lib.split "/" secretPath;
+      dirName = lib.elemAt pathParts 2;
+    in
+    if dirName == "global" then
+      # Global secrets: all hosts + admins
+      allHostKeys ++ globalKeys ++ adminKeys
+    else if hostKeys ? ${dirName} then
+      # Host-specific secrets: that host + global keys + admins
+      hostKeys.${dirName} ++ globalKeys ++ adminKeys
+    else
+      # Fallback: just admins
+      adminKeys;
+
+  # Find all secrets across all directories
+  allSecrets = concatLists (lib.map findSecrets directories);
+
+  # Generate the configuration
+  secretsConfig = lib.listToAttrs (
+    lib.map (
+      secretPath:
+      let
+        recipients = getRecipients secretPath;
+        # Remove duplicates and empty keys
+        uniqueRecipients = unique (lib.filter (k: k != null && k != "") recipients);
+      in
+      nameValuePair secretPath {
+        publicKeys = uniqueRecipients;
+      }
+    ) allSecrets
+  );
+
+  # Generate wildcard rules for each directory to allow creating new secrets
+  wildcardRules = lib.listToAttrs (
+    lib.concatMap (dir: [
+      # Match with and without .age extension for ragenix compatibility
+      (nameValuePair "secrets/${dir}/*" {
+        publicKeys =
+          let
+            recipients = getRecipients "secrets/${dir}/dummy.age";
+          in
+          unique (lib.filter (k: k != null && k != "") recipients);
+      })
+      (nameValuePair "secrets/${dir}/*.age" {
+        publicKeys =
+          let
+            recipients = getRecipients "secrets/${dir}/dummy.age";
+          in
+          unique (lib.filter (k: k != null && k != "") recipients);
+      })
+    ]) (lib.filter (d: d != "admins") directories)
+  );
+
+in
+secretsConfig // wildcardRules

secrets/DESIGN.md

@@ -0,0 +1,174 @@
+# Athenix Secrets System Design
+
+## Overview
+
+The Athenix secrets management system integrates ragenix (agenix) with automatic host discovery based on the repository's fleet inventory structure. It provides a seamless workflow for managing encrypted secrets across all systems.
+
+## Architecture
+
+### Auto-Discovery Module (`sw/secrets.nix`)
+
+**Purpose**: Automatically load and configure secrets at system deployment time.
+
+**Features**:
+- Discovers `.age` encrypted files from `secrets/` directories
+- Loads global secrets from `secrets/global/` on ALL systems
+- Loads host-specific secrets from `secrets/{hostname}/` on matching hosts
+- Auto-configures decryption keys based on `.pub` files in directories
+- Supports custom secret configuration via `default.nix` in each directory
+
+**Key Behaviors**:
+- Secrets are decrypted to `/run/agenix/{name}` at boot
+- Identity paths include: system SSH keys + global keys + host-specific keys
+- Host-specific secrets override global secrets with the same name
+
+### Dynamic Recipients Configuration (`secrets/secrets.nix`)
+
+**Purpose**: Generate ragenix recipient configuration from directory structure.
+
+**Features**:
+- Automatically discovers hosts from `secrets/` subdirectories
+- Reads age public keys from `.age.pub` files (converted from SSH keys)
+- Generates recipient lists based on secret location:
+  - `secrets/global/*.age` → ALL hosts + admins
+  - `secrets/{hostname}/*.age` → that host + global keys + admins
+- Supports admin keys in `secrets/admins/` for secret editing
+
+**Key Behaviors**:
+- No manual recipient list maintenance required
+- Adding a new host = create directory + add .pub key + run `update-age-keys.sh`
+- Works with ragenix CLI: `ragenix -e`, `ragenix -r`
+
+## Workflow
+
+### Adding a New Host
+
+1. **Capture SSH host key**:
+   ```bash
+   # From the running system
+   cat /etc/ssh/ssh_host_ed25519_key.pub > secrets/new-host/ssh_host_ed25519_key.pub
+   ```
+
+2. **Convert to age format**:
+   ```bash
+   cd secrets/
+   ./update-age-keys.sh
+   ```
+
+3. **Re-key existing secrets** (if needed):
+   ```bash
+   ragenix -r
+   ```
+
+### Creating a New Secret
+
+1. **Choose location**:
+   - `secrets/global/` → all systems can decrypt
+   - `secrets/{hostname}/` → only that host can decrypt
+
+2. **Create/edit secret**:
+   ```bash
+   ragenix -e secrets/global/my-secret.age
+   ```
+   
+3. **Recipients are auto-determined** from `secrets.nix`:
+   - Global secrets: all host keys + admin keys
+   - Host-specific: that host + global keys + admin keys
+
+### Cross-Host Secret Management
+
+Any Athenix host can manage secrets for other hosts because:
+- All public keys are in the repository (`*.age.pub` files)
+- `secrets/secrets.nix` auto-generates recipient lists
+- Hosts decrypt using their own private keys (not shared)
+
+Example: From `nix-builder`, create a secret for `usda-dash`:
+```bash
+ragenix -e secrets/usda-dash/database-password.age
+# Encrypted for usda-dash's public key + admins
+# usda-dash will decrypt using its private key at /etc/ssh/ssh_host_ed25519_key
+```
+
+## Directory Structure
+
+```
+secrets/
+├── secrets.nix              # Auto-generated recipient config
+├── update-age-keys.sh       # Helper to convert SSH → age keys
+├── README.md                # User documentation
+├── DESIGN.md                # This file
+│
+├── global/                  # Secrets for ALL hosts
+│   ├── *.pub                # SSH public keys
+│   ├── *.age.pub            # Age public keys (generated)
+│   ├── *.age                # Encrypted secrets
+│   └── default.nix          # Optional: custom secret config
+│
+├── {hostname}/              # Host-specific secrets
+│   ├── *.pub
+│   ├── *.age.pub
+│   ├── *.age
+│   └── default.nix
+│
+└── admins/                  # Admin keys for editing
+    └── *.age.pub
+```
+
+## Security Model
+
+1. **Public keys in git**: Safe to commit (only public keys, `.age.pub` and `.pub`)
+2. **Private keys on hosts**: Never leave the system (`/etc/ssh/ssh_host_*_key`, `/etc/age/identity.key`)
+3. **Encrypted secrets in git**: Safe to commit (`.age` files)
+4. **Decrypted secrets**: Only in memory/tmpfs (`/run/agenix/*`)
+
+## Integration Points
+
+### With NixOS Configuration
+
+```nix
+# Access decrypted secrets in any NixOS module
+config.age.secrets.my-secret.path  # => /run/agenix/my-secret
+
+# Example usage
+services.myapp.passwordFile = config.age.secrets.database-password.path;
+```
+
+### With Inventory System
+
+The system automatically matches `secrets/{hostname}/` to hostnames from `inventory.nix`. No manual configuration needed.
+
+### With External Modules
+
+External user/system modules can reference secrets:
+```nix
+# In external module
+{ config, ... }:
+{
+  programs.git.extraConfig.credential.helper = 
+    "store --file ${config.age.secrets.git-credentials.path}";
+}
+```
+
+## Advantages
+
+1. **Zero manual recipient management**: Just add directories and keys
+2. **Cross-host secret creation**: Any host can manage secrets for others
+3. **Automatic host discovery**: Syncs with inventory structure
+4. **Flexible permission model**: Global vs host-specific + custom configs
+5. **Version controlled**: All public data in git, auditable history
+6. **Secure by default**: Private keys never shared, secrets encrypted at rest
+
+## Limitations
+
+1. **Requires age key conversion**: SSH keys must be converted to age format (automated by script)
+2. **Bootstrap chicken-egg**: Need initial host key before encrypting secrets (capture from first boot or generate locally)
+3. **No secret rotation automation**: Must manually re-key with `ragenix -r`
+4. **Git history contains old encrypted versions**: Rotating keys doesn't remove old ciphertexts from history
+
+## Future Enhancements
+
+- Auto-run `update-age-keys.sh` in pre-commit hook
+- Integrate with inventory.nix to auto-generate host directories
+- Support for multiple identity types per host
+- Automated secret rotation scheduling
+- Integration with hardware security modules (YubiKey, etc.)

secrets/README.md

@@ -0,0 +1,250 @@
+# Secrets Management with Agenix
+
+This directory contains age-encrypted secrets for Athenix hosts. Secrets are automatically loaded based on directory structure.
+
+## Directory Structure
+
+```
+secrets/
+├── global/              # Secrets installed on ALL systems
+│   ├── default.nix      # Optional: Custom config for global secrets
+│   └── example.age      # Decrypted to /run/agenix/example on all hosts
+├── nix-builder/         # Secrets only for nix-builder host
+│   ├── default.nix      # Optional: Custom config for nix-builder secrets
+│   └── ssh_host_ed25519_key.age
+└── usda-dash/           # Secrets only for usda-dash host
+    └── ssh_host_ed25519_key.age
+```
+
+## How It Works
+
+1. **Global secrets** (`./secrets/global/*.age`) are installed on every system
+2. **Host-specific secrets** (`./secrets/{hostname}/*.age`) are only installed on matching hosts
+3. Only `.age` encrypted files are loaded; `.pub` public keys are ignored
+4. Secrets are decrypted at boot to `/run/agenix/{secret-name}` with mode `0400` and owner `root:root`
+5. **Custom configurations** can be defined in `default.nix` files within each directory
+
+## Creating Secrets
+
+### 1. Generate Age Keys
+
+For a new host, generate an age identity:
+```bash
+# On the target system
+mkdir -p /etc/age
+age-keygen -o /etc/age/identity.key
+chmod 600 /etc/age/identity.key
+```
+
+Or use SSH host keys (automatically done by Athenix):
+```bash
+# Get the age public key from SSH host key
+nix shell nixpkgs#ssh-to-age -c sh -c 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
+```
+
+### 2. Store Public Keys
+
+Save the public key to `secrets/{hostname}/` for reference:
+```bash
+# Example for nix-builder
+echo "age1..." > secrets/nix-builder/identity.pub
+```
+
+Or from SSH host key:
+```bash
+cat /etc/ssh/ssh_host_ed25519_key.pub > secrets/nix-builder/ssh_host_ed25519_key.pub
+```
+
+**Then convert SSH keys to age format:**
+```bash
+cd secrets/
+./update-age-keys.sh
+```
+
+This creates `.age.pub` files that `secrets.nix` uses for ragenix recipient configuration.
+
+### 3. Encrypt Secrets
+
+Encrypt a secret for specific hosts:
+```bash
+# For a single host
+age -r age1publickey... -o secrets/nix-builder/my-secret.age <<< "secret value"
+
+# For multiple hosts (recipient list)
+age -R recipients.txt -o secrets/global/shared-secret.age < plaintext-file
+
+# Using SSH public keys
+age -R secrets/nix-builder/ssh_host_ed25519_key.pub \
+    -o secrets/nix-builder/ssh_host_key.age < /etc/ssh/ssh_host_ed25519_key
+```
+
+### 4. Creating and Editing Secrets
+
+**For new secrets**, use the helper script (automatically determines recipients):
+
+```bash
+cd secrets/
+
+# Create a host-specific secret
+./create-secret.sh usda-dash/database-url.age <<< "postgresql://..."
+
+# Create a global secret
+echo "shared-api-key" | ./create-secret.sh global/api-key.age
+
+# From a file
+./create-secret.sh nix-builder/ssh-key.age < ~/.ssh/id_ed25519
+```
+
+The script automatically includes the correct recipients:
+- **Host-specific**: that host's keys + global keys + admin keys
+- **Global**: all host keys + admin keys
+
+**To edit existing secrets**, use `ragenix`:
+
+```bash
+# Install ragenix
+nix shell github:yaxitech/ragenix
+
+# Edit an existing secret (you must have a decryption key)
+ragenix -e secrets/global/existing-secret.age
+
+# Re-key all secrets after adding new hosts
+ragenix -r
+```
+
+**Why create with `age` first?** Ragenix requires the `.age` file to exist before editing. The `secrets/secrets.nix` configuration auto-discovers recipients from the directory structure, but ragenix doesn't support wildcard patterns for creating new files.
+
+**Recipient management** is automatic:
+- **Global secrets** (`secrets/global/*.age`): encrypted for ALL hosts + admins
+- **Host secrets** (`secrets/{hostname}/*.age`): encrypted for that host + global keys + admins
+- **Admin keys** from `secrets/admins/*.age.pub` allow editing from your workstation
+
+After creating new .age files with `age`, use `ragenix -r` to re-key all secrets with the updated recipient configuration.
+
+To add admin keys for editing secrets:
+```bash
+# Generate personal age key
+age-keygen -o ~/.config/age/personal.key
+
+# Extract public key and add to secrets
+grep "public key:" ~/.config/age/personal.key | cut -d: -f2 | tr -d ' ' > secrets/admins/your-name.age.pub
+```
+
+## Using Secrets in Configuration
+
+Secrets are automatically loaded. Reference them in your NixOS configuration:
+
+```nix
+# Example: Using a secret for a service
+services.myservice = {
+  enable = true;
+  passwordFile = config.age.secrets.my-password.path;  # /run/agenix/my-password
+};
+
+# Example: Setting up SSH host key from secret
+services.openssh = {
+  hostKeys = [{
+    path = config.age.secrets.ssh_host_ed25519_key.path;
+    type = "ed25519";
+  }];
+};
+```
+
+## Custom Secret Configuration
+
+For secrets needing custom permissions, use `athenix.sw.secrets.extraSecrets`:
+
+```nix
+# In inventory.nix or host config
+athenix.sw.secrets.extraSecrets = {
+  "nginx-cert" = {
+    file = ./secrets/custom/cert.age;
+    mode = "0440";
+    owner = "nginx";
+    group = "nginx";
+  };
+};
+```
+
+### Using default.nix in Secret Directories
+
+Alternatively, create a `default.nix` file in the secret directory to configure all secrets in that directory:
+
+```nix
+# secrets/global/default.nix
+{
+  "example" = {
+    mode = "0440";        # Custom file mode (default: "0400")
+    owner = "nginx";      # Custom owner (default: "root")
+    group = "nginx";      # Custom group (default: "root")
+    path = "/run/secrets/example";  # Custom path (default: /run/agenix/{name})
+  };
+  
+  "api-key" = {
+    mode = "0400";
+    owner = "myservice";
+    group = "myservice";
+  };
+}
+```
+
+The `default.nix` file should return an attribute set where:
+- **Keys** are secret names (without the `.age` extension)
+- **Values** are configuration objects with optional fields:
+  - `mode` - File permissions (string, e.g., `"0440"`)
+  - `owner` - File owner (string, e.g., `"nginx"`)
+  - `group` - File group (string, e.g., `"nginx"`)
+  - `path` - Custom installation path (string, e.g., `"/custom/path"`)
+  
+Secrets not listed in `default.nix` will use default settings.
+
+## Security Best Practices
+
+1. **Never commit unencrypted secrets** - Only `.age` and `.pub` files belong in this directory
+2. **Use host-specific secrets** when possible - Limit exposure by using hostname directories
+3. **Rotate secrets regularly** - Re-encrypt with new keys periodically
+4. **Backup age identity keys** - Store `/etc/age/identity.key` securely offline
+5. **Use SSH keys** - Leverage existing SSH host keys for age encryption when possible
+6. **Pin to commits** - When using external secrets modules, always use `rev = "commit-hash"`
+
+## Converting SSH Keys to Age Format
+
+```bash
+# Convert SSH public key to age public key
+nix shell nixpkgs#ssh-to-age -c ssh-to-age < secrets/nix-builder/ssh_host_ed25519_key.pub
+
+# Convert SSH private key to age identity (for editing secrets)
+nix shell nixpkgs#ssh-to-age -c ssh-to-age -private-key -i ~/.ssh/id_ed25519
+```
+
+## Disabling Automatic Secrets
+
+To disable automatic secret loading:
+
+```nix
+# In inventory.nix or host config
+athenix.sw.secrets.enable = false;
+```
+
+## Troubleshooting
+
+### Secret not found
+- Ensure the `.age` file exists in `secrets/global/` or `secrets/{hostname}/`
+- Check `hostname` matches directory name: `echo $HOSTNAME` on the target system
+- Run `nix flake check` to verify secrets are discovered
+
+### Permission denied
+- Verify secret permissions in `/run/agenix/`
+- Check if custom permissions are needed (use `extraSecrets`)
+- Ensure the service user/group has access to the secret file
+
+### Age decrypt failed
+- Verify the host's age identity exists: `ls -l /etc/age/identity.key`
+- Check that the secret was encrypted with the host's public key
+- Confirm SSH host key hasn't changed (would change derived age key)
+
+## References
+
+- [ragenix GitHub](https://github.com/yaxitech/ragenix)
+- [agenix upstream](https://github.com/ryantm/agenix)
+- [age encryption tool](https://age-encryption.org/)

secrets/admins/temp-admin.age.pub

@@ -0,0 +1 @@
+age14emzyraytqzmre58c452t07rtcj87cwqwmd9z3gj7upugtxk8s3sda5tju

secrets/create-secret.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Create a new age-encrypted secret with auto-determined recipients
+# Usage: ./create-secret.sh <path> [content]
+#   path: relative to secrets/ (e.g., "usda-dash/my-secret.age" or "global/shared.age")
+#   content: stdin if not provided
+
+SECRETS_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+if [ $# -lt 1 ]; then
+    echo "Usage: $0 <path> [content]" >&2
+    echo "Examples:" >&2
+    echo "  $0 usda-dash/database-url.age <<< 'postgresql://...'" >&2
+    echo "  $0 global/api-key.age < secret-file.txt" >&2
+    echo "  echo 'secret' | $0 nix-builder/token.age" >&2
+    exit 1
+fi
+
+SECRET_PATH="$1"
+shift
+
+# Extract directory from path (e.g., "usda-dash/file.age" -> "usda-dash")
+SECRET_DIR="$(dirname "$SECRET_PATH")"
+SECRET_FILE="$(basename "$SECRET_PATH")"
+
+# Ensure .age extension
+if [[ ! "$SECRET_FILE" =~ \.age$ ]]; then
+    echo "Error: Secret file must have .age extension" >&2
+    exit 1
+fi
+
+TARGET_FILE="$SECRETS_DIR/$SECRET_PATH"
+
+# Ensure target directory exists
+mkdir -p "$(dirname "$TARGET_FILE")"
+
+# Collect recipient keys
+RECIPIENTS=()
+
+if [ "$SECRET_DIR" = "global" ]; then
+    echo "Creating global secret (encrypted for all hosts + admins)..." >&2
+    
+    # Add all host keys
+    for host_dir in "$SECRETS_DIR"/*/; do
+        host_name="$(basename "$host_dir")"
+        # Skip non-host directories
+        if [ "$host_name" = "admins" ] || [ "$host_name" = "global" ]; then
+            continue
+        fi
+        
+        # Add all .age.pub files from this host
+        while IFS= read -r -d '' key_file; do
+            RECIPIENTS+=("$key_file")
+        done < <(find "$host_dir" -maxdepth 1 -name "*.age.pub" -print0)
+    done
+    
+    # Add global keys
+    while IFS= read -r -d '' key_file; do
+        RECIPIENTS+=("$key_file")
+    done < <(find "$SECRETS_DIR/global" -maxdepth 1 -name "*.age.pub" -print0 2>/dev/null || true)
+    
+else
+    echo "Creating host-specific secret for $SECRET_DIR..." >&2
+    
+    # Check if host directory exists
+    if [ ! -d "$SECRETS_DIR/$SECRET_DIR" ]; then
+        echo "Error: Host directory $SECRET_DIR does not exist" >&2
+        echo "Create it first: mkdir -p secrets/$SECRET_DIR" >&2
+        exit 1
+    fi
+    
+    # Add this host's keys
+    while IFS= read -r -d '' key_file; do
+        RECIPIENTS+=("$key_file")
+    done < <(find "$SECRETS_DIR/$SECRET_DIR" -maxdepth 1 -name "*.age.pub" -print0)
+    
+    # Add global keys (so global hosts can also decrypt)
+    while IFS= read -r -d '' key_file; do
+        RECIPIENTS+=("$key_file")
+    done < <(find "$SECRETS_DIR/global" -maxdepth 1 -name "*.age.pub" -print0 2>/dev/null || true)
+fi
+
+# Add admin keys (for editing from workstations)
+if [ -d "$SECRETS_DIR/admins" ]; then
+    while IFS= read -r -d '' key_file; do
+        RECIPIENTS+=("$key_file")
+    done < <(find "$SECRETS_DIR/admins" -maxdepth 1 -name "*.age.pub" -print0 2>/dev/null || true)
+fi
+
+# Check if we have any recipients
+if [ ${#RECIPIENTS[@]} -eq 0 ]; then
+    echo "Error: No recipient keys found!" >&2
+    echo "Run ./update-age-keys.sh first to generate .age.pub files" >&2
+    exit 1
+fi
+
+echo "Found ${#RECIPIENTS[@]} recipient key(s):" >&2
+for key in "${RECIPIENTS[@]}"; do
+    echo "  - $(basename "$key")" >&2
+done
+
+# Create recipient list file (temporary)
+RECIPIENT_LIST=$(mktemp)
+trap "rm -f $RECIPIENT_LIST" EXIT
+
+for key in "${RECIPIENTS[@]}"; do
+    cat "$key" >> "$RECIPIENT_LIST"
+done
+
+# Encrypt the secret
+if [ $# -gt 0 ]; then
+    # Content provided as argument
+    echo "$@" | age -R "$RECIPIENT_LIST" -o "$TARGET_FILE"
+else
+    # Content from stdin
+    age -R "$RECIPIENT_LIST" -o "$TARGET_FILE"
+fi
+
+echo "✓ Created $TARGET_FILE" >&2
+echo "  Edit with: ragenix -e secrets/$SECRET_PATH" >&2

secrets/global/hunter_halloran_key.age.pub

@@ -0,0 +1 @@
+age1udmpqkedupd33gyut85ud3nvppydzeg04kkuneymkvxcjjej244s4v8xjc

secrets/nix-builder/default.nix

@@ -0,0 +1,10 @@
+# Host-specific secret configuration for nix-builder
+{
+  # SSH host key should be readable by sshd
+  ssh_host_ed25519_key = {
+    mode = "0600";
+    owner = "root";
+    group = "root";
+    path = "/etc/ssh/ssh_host_ed25519_key";
+  };
+}

secrets/nix-builder/ssh_host_ed25519_key.age.pub

@@ -0,0 +1 @@
+age1u5tczg2sx90n03uuz9h549f4h3h7sq5uehhqpampzs7vj8ew7y6s2mjwz0

secrets/secrets.nix

@@ -0,0 +1,176 @@
+# ============================================================================
+# Agenix Secret Recipients Configuration (Auto-Generated)
+# ============================================================================
+# This file automatically discovers hosts and their public keys from the
+# secrets/ directory structure and generates recipient configurations.
+#
+# Directory structure:
+#   secrets/{hostname}/*.pub  -> SSH/age public keys for that host
+#   secrets/global/*.pub      -> Keys accessible to all hosts
+#
+# Usage:
+#   ragenix -e secrets/global/example.age     # Edit/create secret
+#   ragenix -r                                # Re-key all secrets
+#
+# To add admin keys for editing secrets, create secrets/admins/*.pub files
+# with your personal age public keys (generated with: age-keygen)
+
+let
+  lib = builtins;
+
+  # Helper functions not in builtins
+  filterAttrs =
+    pred: set:
+    lib.listToAttrs (
+      lib.filter (item: pred item.name item.value) (
+        lib.map (name: {
+          inherit name;
+          value = set.${name};
+        }) (lib.attrNames set)
+      )
+    );
+
+  concatLists = lists: lib.foldl' (acc: list: acc ++ list) [ ] lists;
+
+  unique =
+    list:
+    let
+      go =
+        acc: remaining:
+        if remaining == [ ] then
+          acc
+        else if lib.elem (lib.head remaining) acc then
+          go acc (lib.tail remaining)
+        else
+          go (acc ++ [ (lib.head remaining) ]) (lib.tail remaining);
+    in
+    go [ ] list;
+
+  hasSuffix =
+    suffix: str:
+    let
+      lenStr = lib.stringLength str;
+      lenSuffix = lib.stringLength suffix;
+    in
+    lenStr >= lenSuffix && lib.substring (lenStr - lenSuffix) lenSuffix str == suffix;
+
+  nameValuePair = name: value: { inherit name value; };
+
+  secretsPath = ./secrets;
+
+  # Read all directories in secrets/
+  secretDirs = if lib.pathExists secretsPath then lib.readDir secretsPath else { };
+
+  # Filter to only directories (excludes files)
+  isDirectory = name: type: type == "directory";
+  directories = lib.filter (name: isDirectory name secretDirs.${name}) (lib.attrNames secretDirs);
+
+  # Read public keys from a directory and convert to age format
+  readHostKeys =
+    dirName:
+    let
+      dirPath = secretsPath + "/${dirName}";
+      files = if lib.pathExists dirPath then lib.readDir dirPath else { };
+
+      # Prefer .age.pub files (pre-converted), fall back to .pub files
+      agePubFiles = filterAttrs (name: type: type == "regular" && hasSuffix ".age.pub" name) files;
+
+      sshPubFiles = filterAttrs (
+        name: type: type == "regular" && hasSuffix ".pub" name && !(hasSuffix ".age.pub" name)
+      ) files;
+
+      # Read age public keys (already in correct format)
+      ageKeys = lib.map (
+        name:
+        let
+          content = lib.readFile (dirPath + "/${name}");
+          # Trim whitespace/newlines
+          trimmed = lib.replaceStrings [ "\n" " " "\r" "\t" ] [ "" "" "" "" ] content;
+        in
+        trimmed
+      ) (lib.attrNames agePubFiles);
+
+      # For SSH keys, just include them as-is (user needs to convert with ssh-to-age)
+      # Or they can run the update-age-keys.sh script
+      sshKeys =
+        if (lib.length (lib.attrNames sshPubFiles)) > 0 then
+          lib.trace "Warning: ${dirName} has unconverted SSH keys. Run secrets/update-age-keys.sh" [ ]
+        else
+          [ ];
+    in
+    lib.filter (k: k != null && k != "") (ageKeys ++ sshKeys);
+
+  # Build host key mappings: { hostname = [ "age1..." "age2..." ]; }
+  hostKeys = lib.listToAttrs (
+    lib.map (dir: nameValuePair dir (readHostKeys dir)) (
+      lib.filter (d: d != "global" && d != "admins") directories
+    )
+  );
+
+  # Global keys that all hosts can use
+  globalKeys = if lib.elem "global" directories then readHostKeys "global" else [ ];
+
+  # Admin keys for editing secrets
+  adminKeys = if lib.elem "admins" directories then readHostKeys "admins" else [ ];
+
+  # All host keys combined
+  allHostKeys = concatLists (lib.attrValues hostKeys);
+
+  # Find all .age files in the secrets directory
+  findSecrets =
+    dir:
+    let
+      dirPath = secretsPath + "/${dir}";
+      files = if lib.pathExists dirPath then lib.readDir dirPath else { };
+      ageFiles = filterAttrs (name: type: type == "regular" && hasSuffix ".age" name) files;
+    in
+    lib.map (name: "secrets/${dir}/${name}") (lib.attrNames ageFiles);
+
+  # Generate recipient list for a secret based on its location
+  getRecipients =
+    secretPath:
+    let
+      # Extract directory name from path: "secrets/nix-builder/foo.age" -> "nix-builder"
+      pathParts = lib.split "/" secretPath;
+      dirName = lib.elemAt pathParts 2;
+    in
+    if dirName == "global" then
+      # Global secrets: all hosts + admins
+      allHostKeys ++ globalKeys ++ adminKeys
+    else if hostKeys ? ${dirName} then
+      # Host-specific secrets: that host + global keys + admins
+      hostKeys.${dirName} ++ globalKeys ++ adminKeys
+    else
+      # Fallback: just admins
+      adminKeys;
+
+  # Find all secrets across all directories
+  allSecrets = concatLists (lib.map findSecrets directories);
+
+  # Generate the configuration
+  secretsConfig = lib.listToAttrs (
+    lib.map (
+      secretPath:
+      let
+        recipients = getRecipients secretPath;
+        # Remove duplicates and empty keys
+        uniqueRecipients = unique (lib.filter (k: k != null && k != "") recipients);
+      in
+      nameValuePair secretPath {
+        publicKeys = uniqueRecipients;
+      }
+    ) allSecrets
+  );
+
+in
+secretsConfig
+// {
+  # Export helper information for debugging
+  _meta = {
+    hostKeys = hostKeys;
+    globalKeys = globalKeys;
+    adminKeys = adminKeys;
+    allHostKeys = allHostKeys;
+    discoveredSecrets = allSecrets;
+  };
+}

secrets/update-age-keys.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# ============================================================================
+# Update Age Keys from SSH Public Keys
+# ============================================================================
+# This script converts SSH public keys to age format for use with ragenix.
+# Run this after adding new SSH .pub files to create corresponding .age.pub files.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+echo "Converting SSH public keys to age format..."
+
+# Find all .pub files that are SSH keys (not already .age.pub)
+find . -name "*.pub" -not -name "*.age.pub" -type f | while read -r pubkey; do
+    # Check if it's an SSH key
+    if grep -q "^ssh-" "$pubkey" 2>/dev/null || grep -q "^ecdsa-" "$pubkey" 2>/dev/null; then
+        age_key=$(nix shell nixpkgs#ssh-to-age -c ssh-to-age < "$pubkey" 2>/dev/null || true)
+        
+        if [ -n "$age_key" ]; then
+            # Create .age.pub file with the age key
+            age_file="${pubkey%.pub}.age.pub"
+            echo "$age_key" > "$age_file"
+            echo "✓ Converted: $pubkey -> $age_file"
+        else
+            echo "⚠ Skipped: $pubkey (conversion failed)"
+        fi
+    fi
+done
+
+echo ""
+echo "Done! Age public keys have been generated."
+echo "You can now use ragenix to manage secrets:"
+echo "  ragenix -e secrets/global/my-secret.age"
+echo "  ragenix -r  # Re-key all secrets with updated keys"

secrets/usda-dash/default.nix

@@ -0,0 +1,8 @@
+# Host-specific secret configuration for usda-dash
+{
+  usda-vision-azure-env = {
+    mode = "0600";
+    owner = "root";
+    group = "root";
+  };
+}

secrets/usda-dash/ssh_host_ed25519_key.age.pub

@@ -0,0 +1 @@
+age1lr24yvk7rdfh5wkle7h32jpxqxm2e8vk85mc4plv370u2sh4yfmszaaejx

secrets/usda-dash/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHI73LOEK2RgfjhZWpryntlLbx0LouHrhQ6v0vZu4Etr root@usda-dash

sw/default.nix

@@ -26,6 +26,7 @@ in
     ./gc.nix
     ./updater.nix
     ./update-ref.nix
+    ./secrets.nix
     ./desktop
     ./headless
     ./builders

sw/ghostty.nix

@@ -1,4 +1,6 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
@@ -10,7 +12,11 @@
 # It reconstructs the terminfo database from the provided definition and
 # adds it to the system packages.
 
+with lib;
+
 let
+  cfg = config.athenix.sw;
+
   ghostty-terminfo = pkgs.runCommand "ghostty-terminfo" { } ''
     mkdir -p $out/share/terminfo
     cat > ghostty.info <<'EOF'
@@ -99,5 +105,7 @@ let
   '';
 in
 {
+  config = mkIf cfg.enable {
     environment.systemPackages = [ ghostty-terminfo ];
+  };
 }

sw/python.nix

@@ -18,11 +18,28 @@ let
   cfg = config.athenix.sw.python;
 in
 {
-  options.athenix.sw.python = {
-    enable = mkEnableOption "Python development tools (pixi, uv)" // {
+  options.athenix.sw.python = lib.mkOption {
+    type = lib.types.submodule {
+      options = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = true;
+          description = ''
+            Enable Python development tools (pixi, uv).
+
+            Provides:
+            - pixi: Fast, cross-platform package manager for Python
+            - uv: Extremely fast Python package installer and resolver
+
+            These tools manage project-based dependencies rather than global
+            Python packages, avoiding conflicts and improving reproducibility.
+          '';
         };
       };
+    };
+    default = { };
+    description = "Python development environment configuration.";
+  };
 
   config = mkIf cfg.enable {
     environment.systemPackages = [

sw/secrets.nix

@@ -0,0 +1,230 @@
+# ============================================================================
+# Automatic Secret Management with Agenix
+# ============================================================================
+# This module automatically loads age-encrypted secrets from ./secrets based on
+# the hostname. Secrets are organized by directory:
+#   - ./secrets/global/          -> Installed on ALL systems
+#   - ./secrets/{hostname}/      -> Installed only on matching host
+#
+# Secret files should be .age encrypted files. Public keys (.pub) are ignored.
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.athenix.sw;
+  secretsPath = ../secrets;
+
+  # Get the fleet-assigned hostname (avoids issues with LXC empty hostnames)
+  hostname = config.athenix.host.name;
+
+  # Read all directories in ./secrets
+  secretDirs = if builtins.pathExists secretsPath then builtins.readDir secretsPath else { };
+
+  # Filter to only directories (excludes files)
+  isDirectory = name: type: type == "directory";
+  directories = lib.filterAttrs isDirectory secretDirs;
+
+  # Read secrets from a specific directory
+  readSecretsFromDir =
+    dirName:
+    let
+      dirPath = secretsPath + "/${dirName}";
+      files = builtins.readDir dirPath;
+
+      # Check if there's a default.nix with custom secret configurations
+      hasDefaultNix = files ? "default.nix";
+      customConfigs = if hasDefaultNix then import (dirPath + "/default.nix") else { };
+
+      # Only include .age files (exclude .pub public keys and other files)
+      secretFiles = lib.filterAttrs (name: type: type == "regular" && lib.hasSuffix ".age" name) files;
+    in
+    lib.mapAttrs' (
+      name: _:
+      let
+        # Remove .age extension for the secret name
+        secretName = lib.removeSuffix ".age" name;
+
+        # Get custom config for this secret if defined
+        customConfig = customConfigs.${secretName} or { };
+
+        # Base configuration with file path
+        baseConfig = {
+          file = dirPath + "/${name}";
+        };
+      in
+      lib.nameValuePair secretName (baseConfig // customConfig)
+    ) secretFiles;
+
+  # Read public keys from a specific directory and map to private key paths
+  readIdentityPathsFromDir =
+    dirName:
+    let
+      dirPath = secretsPath + "/${dirName}";
+      files = if builtins.pathExists dirPath then builtins.readDir dirPath else { };
+      # Only include .pub public key files
+      pubKeyFiles = lib.filterAttrs (name: type: type == "regular" && lib.hasSuffix ".pub" name) files;
+    in
+    lib.mapAttrsToList (
+      name: _:
+      let
+        # Map public key filename to expected private key location
+        baseName = lib.removeSuffix ".pub" name;
+        filePath = dirPath + "/${name}";
+        fileContent = builtins.readFile filePath;
+        # Check if it's an SSH key by looking at the content
+        isSSHKey = lib.hasPrefix "ssh-" fileContent || lib.hasPrefix "ecdsa-" fileContent;
+      in
+      if lib.hasPrefix "ssh_host_" name then
+        # SSH host keys: ssh_host_ed25519_key.pub -> /etc/ssh/ssh_host_ed25519_key
+        "/etc/ssh/${baseName}"
+      else if name == "identity.pub" then
+        # Standard age identity: identity.pub -> /etc/age/identity.key
+        "/etc/age/identity.key"
+      else if isSSHKey then
+        # Other SSH keys (user keys, etc.): hunter_halloran_key.pub -> /etc/ssh/hunter_halloran_key
+        "/etc/ssh/${baseName}"
+      else
+        # Generic age keys: key.pub -> /etc/age/key
+        "/etc/age/${baseName}"
+    ) pubKeyFiles;
+
+  # Determine which secrets apply to this host
+  applicableSecrets =
+    let
+      # Global secrets apply to all hosts
+      globalSecrets = if directories ? "global" then readSecretsFromDir "global" else { };
+
+      # Host-specific secrets
+      hostSecrets = if directories ? ${hostname} then readSecretsFromDir hostname else { };
+    in
+    globalSecrets // hostSecrets; # Host-specific secrets override global if same name
+
+  # Determine which identity paths (private keys) to use for decryption
+  identityPaths =
+    let
+      # Global identity paths (keys in global/ that all hosts can use)
+      globalPaths = if directories ? "global" then readIdentityPathsFromDir "global" else [ ];
+
+      # Host-specific identity paths
+      hostPaths = if directories ? ${hostname} then readIdentityPathsFromDir hostname else [ ];
+
+      # Default paths that NixOS/agenix use
+      defaultPaths = [
+        "/etc/ssh/ssh_host_rsa_key"
+        "/etc/ssh/ssh_host_ed25519_key"
+        "/etc/age/identity.key"
+      ];
+
+      # Combine all paths and remove duplicates
+      allPaths = lib.unique (defaultPaths ++ globalPaths ++ hostPaths);
+    in
+    allPaths;
+in
+{
+  options.athenix.sw.secrets = {
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Enable automatic secret management using agenix.
+
+        Secrets are loaded from ./secrets based on directory structure:
+        - ./secrets/global/       -> All systems
+        - ./secrets/{hostname}/   -> Specific host only
+
+        Only .age encrypted files are loaded; .pub files are ignored.
+      '';
+    };
+
+    extraSecrets = mkOption {
+      type = types.attrsOf (
+        types.submodule {
+          options = {
+            file = mkOption {
+              type = types.path;
+              description = "Path to the encrypted secret file";
+            };
+            mode = mkOption {
+              type = types.str;
+              default = "0400";
+              description = "Permissions mode for the decrypted secret";
+            };
+            owner = mkOption {
+              type = types.str;
+              default = "root";
+              description = "Owner of the decrypted secret file";
+            };
+            group = mkOption {
+              type = types.str;
+              default = "root";
+              description = "Group of the decrypted secret file";
+            };
+          };
+        }
+      );
+      default = { };
+      description = ''
+        Additional secrets to define manually, beyond the auto-discovered ones.
+        Use this for secrets that need custom permissions or are stored elsewhere.
+      '';
+      example = lib.literalExpression ''
+        {
+          "my-secret" = {
+            file = ./secrets/custom/secret.age;
+            mode = "0440";
+            owner = "nginx";
+            group = "nginx";
+          };
+        }
+      '';
+    };
+  };
+
+  config = mkIf (cfg.enable && cfg.secrets.enable) {
+    # Auto-discovered secrets with default permissions
+    age.secrets = applicableSecrets // cfg.secrets.extraSecrets;
+
+    # Generate age identity files from SSH host keys at boot
+    # This is needed because age can't reliably use OpenSSH private keys directly
+    # Must run before agenix tries to decrypt secrets
+    system.activationScripts.convertSshToAge = {
+      deps = [
+        "users"
+        "groups"
+      ];
+      text = ''
+        mkdir -p /etc/age
+        if [ -f /etc/ssh/ssh_host_ed25519_key ]; then
+          ${pkgs.ssh-to-age}/bin/ssh-to-age -private-key -i /etc/ssh/ssh_host_ed25519_key > /etc/age/ssh_host_ed25519.age || true
+          chmod 600 /etc/age/ssh_host_ed25519.age 2>/dev/null || true
+        fi
+        if [ -f /etc/ssh/ssh_host_rsa_key ]; then
+          ${pkgs.ssh-to-age}/bin/ssh-to-age -private-key -i /etc/ssh/ssh_host_rsa_key > /etc/age/ssh_host_rsa.age 2>/dev/null || true
+          chmod 600 /etc/age/ssh_host_rsa.age 2>/dev/null || true
+        fi
+      '';
+    };
+
+    # Add the converted age keys to identity paths (in addition to auto-discovered ones)
+    age.identityPaths = identityPaths ++ [
+      "/etc/age/ssh_host_ed25519.age"
+      "/etc/age/ssh_host_rsa.age"
+    ];
+
+    # Optional: Add assertion to warn if no secrets found
+    warnings =
+      let
+        hasSecrets = (builtins.length (builtins.attrNames applicableSecrets)) > 0;
+      in
+      lib.optional (
+        !hasSecrets
+      ) "No age-encrypted secrets found in ./secrets/global/ or ./secrets/${hostname}/";
+  };
+}

sw/stateless-kiosk/kiosk-browser.nix

@@ -1,13 +1,13 @@
 # This module configures Chromium for kiosk mode under Sway.
 # It includes a startup script that determines the kiosk URL based on the machine's MAC address.
 {
-  lib,
   pkgs,
+  inputs,
   ...
 }:
 
 let
-  macCaseBuilder = (import ./mac-hostmap.nix { inherit lib; }).macCaseBuilder;
+  macCaseBuilder = inputs.self.lib.macCaseBuilder;
   macCases = macCaseBuilder {
     varName = "STATION";
   };

sw/stateless-kiosk/mac-hostmap.nix

@@ -1,28 +0,0 @@
-# Shared MAC address to station mapping and case builder for stateless-kiosk modules
-{ lib }:
-let
-  hostmap = {
-    "00:e0:4c:46:0b:32" = "1";
-    "00:e0:4c:46:07:26" = "2";
-    "00:e0:4c:46:05:94" = "3";
-    "00:e0:4c:46:07:11" = "4";
-    "00:e0:4c:46:08:02" = "5";
-    "00:e0:4c:46:08:5c" = "6";
-  };
-  # macCaseBuilder: builds a shell case statement from a hostmap
-  # varName: the shell variable to assign
-  # prefix: optional string to prepend to the value (default: "")
-  # attrset: attribute set to use (default: hostmap)
-  macCaseBuilder =
-    {
-      varName,
-      prefix ? "",
-      attrset ? hostmap,
-    }:
-    lib.concatStringsSep "\n" (
-      lib.mapAttrsToList (mac: val: "      ${mac}) ${varName}=${prefix}${val} ;;") attrset
-    );
-in
-{
-  inherit hostmap macCaseBuilder;
-}

sw/stateless-kiosk/programs.nix

@@ -1,7 +1,4 @@
 {
-  config,
-  lib,
-  pkgs,
   ...
 }:
 {

sw/stateless-kiosk/services.nix

@@ -1,10 +1,10 @@
 {
-  lib,
   pkgs,
+  inputs,
   ...
 }:
 let
-  macCaseBuilder = (import ./mac-hostmap.nix { inherit lib; }).macCaseBuilder;
+  macCaseBuilder = inputs.self.lib.macCaseBuilder;
   shellCases = macCaseBuilder {
     varName = "NEW_HOST";
     prefix = "nix-station";

sw/update-ref.nix

@@ -1,5 +1,17 @@
-{ pkgs, ... }:
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.athenix.sw;
+in
+{
+  config = mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       python3
       git
@@ -508,4 +520,5 @@
         printf "  rev = %s\n" "$CUR_REV" >&2
       '')
     ];
+  };
 }