feat: forgejo user password

hosts/homelab/configuration.nix

@@ -30,7 +30,7 @@
   home-manager-helper.users."guz" = {
     name = "guz";
     shell = pkgs.zsh;
-    hashedPassword = "$y$j9T$J7gmdB306rufrjdsY5kJq0$spluDZf8jEkG0VYcZXzBIpnACVIk27C8YTbo2vbNFfA";
+    hashedPasswordFile = builtins.toString config.sops.secrets."guz/password".path;
     home = import ./home.nix;
     isNormalUser = true;
     extraGroups = ["wheel" "networkmanager"];

hosts/homelab/secrets.nix

@@ -30,6 +30,10 @@ in {
     sops.defaultSopsFile = ../../secrets/homelab-secrets.yaml;
     sops.defaultSopsFormat = "yaml";
 
+    sops.secrets."guz/password" = {
+      owner = config.users.users."guz".name;
+    };
+
     sops.secrets."forgejo/user1/name" = {
       owner = config.services.forgejo.user;
     };
@@ -39,6 +43,9 @@ in {
     sops.secrets."forgejo/user1/email" = {
       owner = config.services.forgejo.user;
     };
+    sops.secrets."forgejo/git-password" = {
+      owner = config.services.forgejo.user;
+    };
 
     sops.age.keyFile = "/home/guz/.config/sops/age/keys.txt";
   };

hosts/homelab/services.nix

@@ -86,6 +86,14 @@ in {
         };
       };
     };
+    home-manager-helper.users."${config.services.forgejo.user}" = {
+      name = "${config.services.forgejo.user}";
+      hashedPasswordFile = builtins.toString config.sops.secrets."forgejo/git-password".path;
+      isSystemUser = true;
+      homeDirectory = "/var/lib/forgejo";
+      extraGroups = ["wheel" "networkmanager"];
+      useDefaultShell = true;
+    };
 
     services.openssh.enable = true;