made nix-secrets input comment-out-able.

configs/home-manager/email.nix

@@ -24,7 +24,7 @@
 
   programs.himalaya.enable = true;
 
-  accounts.email.accounts.gmail = {
+  accounts.email.accounts.gmail = lib.mkIf (lib.hasAttrByPath ["sops" "secrets" "gmail-password"] config) {
     address = "gabevenberg@gmail.com";
     primary = true;
     flavor = "gmail.com";

configs/home-manager/secrets.nix

@@ -5,15 +5,17 @@
   pkgs,
   ...
 }: let
-  secretsDirectory = builtins.toString inputs.nix-secrets;
+  secretsDirectory = builtins.toString (inputs.nix-secrets or "");
 in {
-  sops = {
-    defaultSopsFile = "${secretsDirectory}/common.yaml";
-    validateSopsFiles = false;
-    age = {
-      sshKeyPaths = ["${config.home.homeDirectory}/.ssh/id_ed25519"];
-      keyFile = "${config.home.homeDirectory}/.config/sops-nix/key.txt";
-      generateKey = true;
+  config = lib.mkIf (inputs ? nix-secrets) {
+    sops = {
+      defaultSopsFile = "${secretsDirectory}/common.yaml";
+      validateSopsFiles = false;
+      age = {
+        sshKeyPaths = ["${config.home.homeDirectory}/.ssh/id_ed25519"];
+        keyFile = "${config.home.homeDirectory}/.config/sops-nix/key.txt";
+        generateKey = true;
+      };
     };
   };
 }

configs/home-manager/tiny-irc.nix

@@ -29,7 +29,7 @@
             "#gamingonlinux"
             "##chat"
           ];
-          sasl = {
+          sasl = lib.mkIf (lib.hasAttrByPath ["sops" "secrets" "irc-cert"] config) {
             username = "toric";
             pem = config.sops.secrets.irc-cert.path;
           };

configs/nixos/common.nix

@@ -4,7 +4,10 @@
   inputs,
   lib,
   ...
-}: {
+}: let
+  # hash for "nixos"
+  defaultPasswordHash = "$y$j9T$u0O3PELyRv3GOemCReQhA0$Qb4Sl6dXnafYwZeDYrJGwS4xp3v6vGriWFMYomHH2w3";
+in {
   nix = {
     package = pkgs.nixFlakes;
     extraOptions = ''
@@ -40,15 +43,22 @@
 
   programs.zsh.enable = lib.mkDefault true;
   environment.shells = lib.mkDefault [pkgs.zsh];
-  users.mutableUsers = false;
+  # if we arent setting our password from nix secrets, we need to allow changing it.
+  users.mutableUsers = !inputs ? nix-secrets;
   users.users.${config.host.user} = {
     isNormalUser = true;
-    hashedPassword = lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash");
+    hashedPassword =
+      if inputs ? nix-secrets
+      then (lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash"))
+      else defaultPasswordHash;
     description = config.host.fullName;
     shell = pkgs.zsh;
     extraGroups = ["wheel"];
   };
-  # users.users.root.password = lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash");
+  users.users.root.password =
+    if inputs ? nix-secrets
+    then (lib.removeSuffix "\n" (builtins.readFile "${inputs.nix-secrets}/password-hash"))
+    else defaultPasswordHash;
 
   imports = [
     ../../modules/hostopts.nix

configs/nixos/secrets.nix

@@ -5,17 +5,20 @@
   pkgs,
   ...
 }: let
-  secretsDirectory = builtins.toString inputs.nix-secrets;
+  secretsDirectory = builtins.toString (inputs.nix-secrets or "");
 in {
   imports = [
     inputs.sops-nix.nixosModules.sops
   ];
-  sops = {
-    validateSopsFiles = false;
-    age = {
-      sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
-      keyFile = "/var/lib/sops-nix/key.txt";
-      generateKey = true;
+  config = lib.mkIf (inputs ? nix-secrets) {
+    sops = {
+      defaultSopsFile = "${secretsDirectory}/common.yaml";
+      validateSopsFiles = false;
+      age = {
+        sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+        keyFile = "/var/lib/sops-nix/key.txt";
+        generateKey = true;
+      };
     };
   };
 }

configs/nixos/sshd.nix

@@ -16,8 +16,11 @@
     kitty.terminfo
   ];
 
-  users.users.root.openssh.authorizedKeys.keys =
-    lib.mkDefault (configLib.dirToStrings "${inputs.nix-secrets}/public-keys");
+  users.users.root.openssh.authorizedKeys.keys = lib.mkDefault (
+    if inputs ? nix-secrets
+    then (configLib.dirToStrings "${inputs.nix-secrets}/public-keys")
+    else []
+  );
   # if it can log into root, it should also be able to log in to the main user.
   users.users.${config.host.user}.openssh.authorizedKeys.keys =
     config.users.users.root.openssh.authorizedKeys.keys;