From 8f4a401491ac5035b2b0b934eb650ae2d3a6642b Mon Sep 17 00:00:00 2001
From: Muse Sweep <muse-sweep@developing-today.dev>
Date: Sun, 25 Oct 2026 23:18:42 +0000
Subject: [PATCH] amd: declare the muse user (sops password hash)

---
 nixos/hosts/default.nix                    |  1 +
 nixos/users/muse/default.nix               | 26 ++++++++++++++++++++++
 secrets/sops/users/muse/password_muse.yaml | 18 +++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 nixos/users/muse/default.nix
 create mode 100644 secrets/sops/users/muse/password_muse.yaml

diff --git a/nixos/hosts/default.nix b/nixos/hosts/default.nix
index 287b2bb50..96c0736a8 100644
--- a/nixos/hosts/default.nix
+++ b/nixos/hosts/default.nix
@@ -36,6 +36,7 @@ in
     users = [
       "user"
       "backup"
+      "muse"
       "root"
     ];
     wireless = [
diff --git a/nixos/users/muse/default.nix b/nixos/users/muse/default.nix
new file mode 100644
index 000000000..f02fc84db
--- /dev/null
+++ b/nixos/users/muse/default.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  imports = [
+    (lib.from-root "nixos/users")
+  ];
+  sops.secrets."users/muse/passwordHash" = {
+    neededForUsers = true;
+    sopsFile = lib.from-root "secrets/sops/users/muse/password_muse.yaml";
+  };
+  users.users.muse = {
+    uid = 1338;
+    isNormalUser = true;
+    hashedPasswordFile = config.sops.secrets."users/muse/passwordHash".path;
+    description = "Muse (AI agent)";
+    extraGroups = [
+      "wheel"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQhcm1Z0TGjZT9JgIugIxJmc6xtcVrTDSI0HweJIDtA hatch"
+    ];
+  };
+}
diff --git a/secrets/sops/users/muse/password_muse.yaml b/secrets/sops/users/muse/password_muse.yaml
new file mode 100644
index 000000000..98a102517
--- /dev/null
+++ b/secrets/sops/users/muse/password_muse.yaml
@@ -0,0 +1,18 @@
+users:
+    muse:
+        passwordHash: ENC[AES256_GCM,data:w9PGtpoaTjT0bca9i81QKaUc0GBFQUnKPCi70ZyMaK09MmotHBojD7VEfATLAa6IJwH8trrTOKX7KE9uLz95lgOPojukJVy5MiBa/tnWrY66xhgGL3KPh+dNkiEHKozv3CLESzoqHkUVMQ==,iv:WzmL9jDp0N91vUEDVuS6QHcbdhcSY4l5kBkN96W7n5U=,tag:dRwv6a2VyGS50n0xOKZOlA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSGRrZXJKNE1RcVdWeU9Y
+            bkI2WmEwWDQyYlQ3NUpWRy9EeEZ5MkJJb0FjCjFsNUlmMnVPSHl5NEJPL0sxa0xR
+            Skp5UzZTRURjNFl5U29YL1VuTlhQSFEKLS0tIC9EOE0zZ2JiOGNTWEc0RGZ4TGdV
+            bDVaZmd0dHhFYU9yeXNRVFp2TU5hQlkKV2zVq1xkMbw0tgBgYC7GrHDCx916QcGf
+            kVXpKHniizZbByKCpME7LvJ94wY/+ZHHeY8zl2G8eLfIORz1zjwEaQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age125acas5y8hnwl5uhcp364xm8zlhtwsjqvxxpge8k04dzzr67acrq0ttc34
+    lastmodified: "2026-10-25T22:28:03Z"
+    mac: ENC[AES256_GCM,data:uoI/JUG+a+FX32xSE6oNKwMGGKsqJ+vXZMmzAG1FmGInvIgrILgNDJ0jLmc4sE33doEwQbtDS8S3CEVUPlgPa3mx327IUIXIETiQPPXTooQkhjROP71ZX7St7l8sLrRKF+RVzjIRRNGC9PFyvM9GF4RIo3Ok1zdhcP56HZ2jQa8=,iv:8jRnCiXxEhQt4JQLGcSh+AhEqmPCdAqw/RHxpp9O0z4=,tag:sC+h4OA2/qYlSwSpsmy4+Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2