fixing issues from first live install try

hosts/desktop/default.nix

@@ -1,8 +1,9 @@
-{ ... }:
+{ config, ... }:
 
 {
   imports = [
     ./disko.nix
+    ./hardware-configuration.nix
   ];
 
   networking.hostName = "desktop";
@@ -11,6 +12,8 @@
     isNormalUser = true;
     home = "/home/user";
 
+    hashedPasswordFile = config.sops.secrets.user-password.path;
+
     extraGroups = [
       "wheel"
       "networkmanager"

hosts/desktop/disko.nix

@@ -21,7 +21,6 @@
 
         luks = {
           size = "100%";
-          label="luks";
 
           content = {
             type = "luks";

hosts/desktop/hardware-configuration.nix

@@ -0,0 +1,27 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

modules/boot.nix

@@ -15,10 +15,4 @@
 
   boot.consoleLogLevel = 3;
   boot.initrd.verbose = false;
-
-  boot.initrd.luks.devices."cryptroot" = {
-    device = "/dev/disk/by-partlabel/luks";
-  };
-
-  fileSystems."/".device = "/dev/mapper/cryptroot";
 }

modules/secrets.nix

@@ -2,4 +2,8 @@
 
 {
   sops.age.keyFile = "/persist/keys/host-age.key";
+
+  sops.secrets.user-password = {
+    sopsFile = ../secrets/user-password.yaml;
+  };
 }

secrets/test.yaml

@@ -1,38 +0,0 @@
-test:
-    message: ENC[AES256_GCM,data:eF4xvJYIkGg1,iv:CVf9AA5hjPBq+wZLpOjmcOZhve2Tsyk/eULXdOp9Q/s=,tag:BrRYXcHOuftG0Vap4bK4ig==,type:str]
-    number: ENC[AES256_GCM,data:M8M=,iv:hgv/5PHEIS1ENu2UGMsKMc+liHMjEafd6ITyZvpGnb8=,tag:Xs/cUc/Ny17Ka8qtQHWMUw==,type:int]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IE5MdVJBQSBBOStPcWx0
-            YkhRNkFKNmhNeHlvQWFYRDJ2UmNMR2lyTWZEV3MrbldmSWd1Sgp4a0FidVJwZ2tv
-            V2JlZjRQT05xZlpoTEFiVUdKVTRVemx3a0dnTm9MRENjCi0tLSBQMGE0aXVQRFQx
-            NjVEWEtNcldHUWlXbmhQRWxXdzk5bzd1RjNmaFdRS1Z3Crl/J6U3WSvIZRreNIXO
-            aTqjTZaahbHjX4pmkDRmSd2o5x1oNksutIoWO5l32tX8SEU3quDj9bDymZIJBp8X
-            86g=
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1yubikey1q26trpwnpym6t9m5qlcfm00kddy3tzex7u8r6ck7sqkq39wxc5wwwafuq89
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IEcyMVBZdyBBdktHQ0px
-            ZVBMNDhteElxVXlUczd5K2I5K25iejNCOEZkTjFDRkwzcUlJWAptRmlpazhsbkY5
-            QnRhamtXR1JObFlTY1FjZ1hIUmxzTTZEYXVrZzlaY2lBCi0tLSBSUlAxOFZlcTFn
-            cEFRR2tIT2liSVAxaHhkcWs4MlQ1cVBTeW9vUm9PcW5VCpQ82CSSMYHMK5Su/An9
-            o6Ybb//z92Xm1fbuCv/1E/yQg12sOClbsJvNPWbwynoWkAmVzureuDzXNgIsv2oA
-            Mt4=
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1yubikey1qgvu222dwg2gtvc4mq2txk79t4ep5gk9qwgfh520lc3m4kyxjmtgzexyljy
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMWthMjdFTElpbzcvcFFQ
-            UzdzbUtpSkVQQWpWTVpxNUcwamlqOE5Nd2hVCkZNeUdvOVF0eWxwZ2F5WlY0UHNv
-            QlFlNUdRSlh6M0xub1dUNkNTWVdxZzQKLS0tIGNQcGdzazZTRll1MEhuZzlxZUM0
-            UEdvV0xsRzRRRUZxZ0NsUFpUSEpKZ2sKQxxSJOQen+whTB4awc7EGSUJO/CWmlOc
-            Srryah6025tEfH+scMxYJcpSMKrQlQ778yvK92xxSJbFgoQi0sReoA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1r993gvlratqk5h5seuzrd8fjv356csnrvtdt5ugcfdu3cw66hdls9gtuwd
-    lastmodified: "2026-09-10T08:56:29Z"
-    mac: ENC[AES256_GCM,data:YOEymqQFlK/4iaQpcA3e7OtuTnqz/52iS+TAc2sSIdKP2TV9NG6tr32Fn66AQrjFfYmfY81LIYFRnqRNV1IH9rccNTvxxklF6wKCz8p0/ESqpKbDEaNsoRzaTHCNRvDu3t8GvrxudDtRXQtQ94yx/WCk/M7XHQuY0LbagJv0Jm0=,iv:AIyGRpYuAsxaD2Rm/CZMUCLEkHCR3ImvJ/GoRwG9FAk=,tag:Fr5T15lfHUv1cIvJmXwZkA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.3

secrets/user-password.yaml

@@ -0,0 +1,36 @@
+user-password: ENC[AES256_GCM,data:0kyCCpjuUEFxw5onG8O/FuAoQgnljNx7rk/4AoTjAFNbxqSy8+xYEFUW83zwg8HTYHw35EE5OqPOMX67TbUiXLpvqzQF1ugs0g==,iv:PWBzbYUew5QVWHyLzRd+iQRN2VhxamSs6Mqp0ccAuBs=,tag:CmTJtrt2KwkfJBlRf1uyjQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IE5MdVJBQSBBK0R5NjZO
+            Qk5WYXRpcUhBOE1TcUd2N2tuTGJrditubHhsTWd0NmJVTlMvMgphUldKdWYwQlVn
+            bFI1VVptcDA3R0hSU2ZTMXhyQnRLLy82WGpIWGtlSUhrCi0tLSBIdTE4S0dSL2Jp
+            WW9iMzNWUm5nZGJwdWFOU1FkZUZwZGRrOWVFdXJOaW8wCrJZ+9nFGLQ+FCn1Mu6S
+            rgfG72JPUAYOCitK01X4US9VQbnyt1VzkBIN1UbgLa8SyQUOIUz5jQX2raxTWlA+
+            3NU=
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1yubikey1q26trpwnpym6t9m5qlcfm00kddy3tzex7u8r6ck7sqkq39wxc5wwwafuq89
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IEcyMVBZdyBBdFlBR2x4
+            L1AvV3oxRFg3ZmUzSnpvc2F4YUp2TzZWSHltV0VnNkR6N2VnWQpqczdIOEZwM0JK
+            MEx2NThpSEVUYVM3aGV0bUVBK3FxOVhVa1ZPZE04WmJFCi0tLSBRd3R3WVRNWGNs
+            WlMrWmJ4bUs3dWZwaStqQzViajN6S0tSL25KMEVYOFlFClNZPzUpNWfwDaoHjIdb
+            dhYlOhYXCsDYwAii2hU8HwyLSgWG1QALOBhZhhyEADRStSujilMLsbsaONCNFSvt
+            mgY=
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1yubikey1qgvu222dwg2gtvc4mq2txk79t4ep5gk9qwgfh520lc3m4kyxjmtgzexyljy
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaazdKTEREeEo0SC9DRE1S
+            K0lQVklWVndQeW9BeEVqN3hPanJmUUR6VmhvClB3MXVZMCsyOHN4bU42VTBoQUtB
+            RFMrN3IxMExBL1A1MWJyZWc1RS9oekEKLS0tIDJJYnc0U01TbjZzYWVsWE5OVlZy
+            b2NFQVFpOTdGVHhMcHBzY2xKYXI5cDQK1atLJ9/8/8yZfXO/WmolvTre+Z1BBvNl
+            Zu4kYHjlfX/wbtDiyyd5rORalUkLUYzK2IZOSjwfCsY+qrjqAlncow==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1r993gvlratqk5h5seuzrd8fjv356csnrvtdt5ugcfdu3cw66hdls9gtuwd
+    lastmodified: "2026-09-10T12:55:42Z"
+    mac: ENC[AES256_GCM,data:V5h1J+jZV7zSo+zCZCmlOjbY1+8f0uDUb3c/0h3Q5llXzkDRJrbhRMLQXgyghvBRq16KrEr+s+JAL7piJkAT5IlIhIQ6xUsr7dTd8JfN008cT1/NqXzkgcsx8/xwL/ABeOJe5d2iXcbpJCMjScDqvGvXgLqeSLfpgPYoA9nsXgI=,iv:FovsxL+GejChvtX5Swkm9x8VU6p5lkTBin/xNkmEfyQ=,tag:TRw/HfkN7kisEYDTlL6AwQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3