allow sudo passwd

test-vms/vm-test/secrets/psql-example.yaml

@@ -1,43 +0,0 @@
-credentials: ENC[AES256_GCM,data:ZExq00BrgRqkouu/hTee5LLsAW8JKqSrAI25vJqkCQ==,iv:JWbVLagZGsYPJh3GiWKAveHt8+eagRP8Uw1/l5f61T0=,tag:70GZuRPn04Y4TKNA2YSJmQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VXJMdFVwRjJwV0daRXNx
-            TE9DUjZkMjJuRHFIZlVwQWsrWGUzZjFBL2w4Cm9QbExCZWVRUnFzVnozMVY2Mlpi
-            U29kNHlZKy80dStBdE1NM2N1cU1rUUEKLS0tIG9iQjVzTENpNlgyRlRTN2ZLclFL
-            MU5WSXptcFREeUJtTVp3ZlcxbUpwTkkKS74kwnEOt8wR8ZxvKgj57B5tzbKED5vA
-            1HWGRRj26PoBDMMKBB2/2qqTEz+hWij9UMxmMTmPe8+5+mhBSN503w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaHNVSEVUSGFONXJya1l0
-            eWh2VzdNNVBrV0dqK2dGZXBTcXd4RXhDUDJjCk9nUE5mS1N0UjdnNWRkTjBHcXdO
-            aWsvNTlBUWJuUU9nL3ptZXBvOGkxcFUKLS0tIHE4ekpzQ2MzK1J3UkFpREhvdUFR
-            Q3hLVXZ3V2hwcWxUdnYyRlhqQTJORE0KBR7OTJ4fE/iudHzgstSPYp5OZYr0GWBf
-            VoLPZ6yNEvW36BmNSuazPq8B9VsOW6PwM315OaROqvfNIL2FaEk3aQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNWU5RGtiMkFlYUF6cUpV
-            YUs2dE9kRXlFbWk3Q29FTGR0bXVzZ3p1eTFJClhXUjBYY25WY2JMQzBJTDA1dFlP
-            UURGZVp4aUZTeHF5bDRjQVU1YVhXYkkKLS0tIDJ3R2tqckJiSEJzN3ozS3QxbDl4
-            dXA5Z2plZzFHM2UvSmg1U21POWkrWmMKeGe3AkWyYQmzclt1ehdgoi3v6fH1+E4a
-            NfZDpl6ksb19ddAvqC0SnWk5NQ+SSVpelZVvqZ/J5/37YEAZHPphaA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZXJ4dFQzVGhNT1RHU2pH
-            ZFNVRm02MzRRcG9yanQxdWFIcHV5QlZBNUI4CjVBS1NDWjk0dGtDODB1M2wyMzVB
-            QTB5UVRnTnBuWGlZdnQyc0pyQk5iakUKLS0tIDloTkJSMVJabWZvbXJFd25RRjR0
-            QWpicXdFUXM0RXhXZ3hsb0o2STVUMHMKkVxR+AWnWuWlohZ5+z4aNoptJ5K3mnGG
-            EfoqN0Y2AeSA8IQKlT3wrYGsulolj940NsDBQREEz8jk1sh3S4bImQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-18T02:12:50Z"
-    mac: ENC[AES256_GCM,data:6XRcEc2D8IabmjAbOpP4UgB4O3y1eWSUAXk+T7Lz3+4fQr6MwnW45IqS3OmdeETWflmPu87d6k7mOtoyYuRoosjzdo4E5f4ujq/3794IHf3oa0FDEepgTadc+Uu8PYCEbEOIK29PdKZg4o69eOzIM62H24NStLTWOI2mp2waIAc=,iv:B2zT2AgDdG3txqU64/PjF/kvfUl+eHtEYaoOtSglS40=,tag:HtgISbKNjzrsBb75fbJAnQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.3

test-vms/vm-test/secrets/psql.yaml

@@ -0,0 +1,43 @@
+credentials: ENC[AES256_GCM,data:T/Kzi6zxovx5/xFZ9RU5g8qrCs+g7O2CNyRmpHbNLQ==,iv:ZExSJqPOq5u+YCAbFnqkonhMC47LQYFkRYwe6d799e0=,tag:mZ0WQaMMTBnUwlsOs/dS4Q==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UitrR2Y3WitTK3BNN3l4
+            anBRMnBmNnlsSnFYMzZSTkorTXdhMzMrQlQ4Ck1hbExpcEhUdlNwRkZUcDlQTmYy
+            WG9OaVFQVVhnc25TWkdwYysvd1VOSWcKLS0tIFBDZmlRNjc1VFRXR1JoR09TOWI4
+            R0h3QkNSRDZjNDlSQkZhMjRUcy9CK3cKDW65gGvBAWVfd1ir2ri3Kd+ISESCAZB6
+            B45JhFGzbi0DZ6OY1ehVT7cQZBnz9pBDw7I/mcu5Rx1kvYkxPRgFAg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaRFJRTkszTnNUbGF6aG5m
+            RW1PTzBzMEdBT1Q2RFpoc1BnNi9MNFVFdFZZCkpKanNaUURSNStxQ3NKQWtjUi9N
+            QlVKeWFacUVXdjRzSHVPazFCODRPbjAKLS0tIDdhN1NSTUJseFNaVTJOZTY5MmhM
+            TGVqa0V6WnprZlhrOC9oS2I3WVBiVjQKTQ/7m3lg5YwcSdyanuqHsPwyoDJdrfRc
+            XX+vVpPChmM5Mne/Bgb6TyLqYuhj0vcd748rnoVmRGBIvGE9xBtCbg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyOVErNmJXRUxZQ0Q3eHd6
+            VitvY0R1clMxenpKUnhYeUt2ekI1YkozWWhRCmppOSs0c1ZUdW5LL1p0WElLRnRz
+            MmFVYW5hRXJya3hyMzFxVzBpUFVJOVUKLS0tIGtPYjliMWpYS1hMYmpaenM1YVRo
+            UDBHS1JPRXNhdlRWU01xNDJuQUk2RlkK8nLganJJZR4OkhtjDuQEIERV+HBrZkso
+            6ikhW5GMtxyMur8Wj9PoF+98EU3qn9qmLeXrLeB/xgLtCp39bi+6Vg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZU0JxUmJBQ1pweWJkVjln
+            OUlsZkhuVjgxQnQ3N3RIcjdUZ1JzblNLS1ZrClozOHZNNlh0clBxSzd5SGpoN1Vj
+            Nm5ydkg4K1RiTWczSDE3SWV0SjEvMDAKLS0tIGNJL3dpMHpsaWl6dnVCRVdMTXg0
+            NFU4QkhrVWFGdlhpVGkzcE9vVGNIc3cKiM41U2ctBiHgrIGPb3ApoAcqgcls0Sjp
+            Wlwsl8I8AwyUYcuLBGTk8WvXRpJI598im/54tZ8sPa7tmokOOilF7w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    lastmodified: "2026-09-18T02:51:05Z"
+    mac: ENC[AES256_GCM,data:Cz1+2ZKOZPX58lHM+U0JyHiSaOO3hzH4FzyxepksuAZNxFCZt8EtsXx99Afb4VCYid3+BWfmwAfd2XAgD0UR3rBCm6BwPd0wujOvv5YpZaDYKHcqVn8JaTuxQldDCArnf0Duks2iAyw6HCgL9LHABX3JRoQgNvz9Kp6oYW1Fsjk=,iv:HBTNsUL5O1YYqADvJfY4Kz1rCbDHHtuDffM2Y7AAXo4=,tag:CpCSMvCVKHT6FohctSOD/g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

test-vms/vm-test/virtual.nix

@@ -9,12 +9,24 @@
   # Allow login and remote control of VM
   users.users.admin = {
     isNormalUser = true;
+    hashedPassword = "$y$j9T$WI7E.NXw4qar1DXodrVWG/$gUErw1R6W8k1UFm49C5.vEc9MT5RcKW0BKitURNqbl/";
     extraGroups = [ "wheel" ];
+
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcofS7u0BYzRBn0i4RuXPHWpnvk3nEbGo9B9ghsR4oL roydumblauskas@gmail.com"
     ];
   };
 
+  # Don't allow password login
+  services.openssh = {
+    enable = true;
+
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
+  };
+
   # ================================ #
   #               SOPS               #
   # ================================ #
@@ -65,7 +77,7 @@
     enable = true;
     dataDir = "/var/lib/postgresql";
     port = 5432;
-    credentialsFile = ./secrets/ex-psql.yaml;
+    credentialsFile = config.sops.secrets."postgresql-credentials".path;
     databases = [
       "test"
     ];