From 7febc62f502aa873dec2bf13bdb9edc75b437cbf Mon Sep 17 00:00:00 2001
From: m3ta-chiron <m3ta-chiron@agentmail.to>
Date: Thu, 2 Jul 2026 19:07:29 +0200
Subject: [PATCH] refactor: resolve nushell secrets path dynamically via
 config.home.username

Replace hardcoded 'm3tam3re-secrets' with '${config.home.username}-secrets'
so the agenix secret file resolves automatically for any user
(m3tam3re, sascha.koenig, bob, etc.).
---
 profiles/base/shell/nushell.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/profiles/base/shell/nushell.nix b/profiles/base/shell/nushell.nix
index 61e2ebc..9529826 100644
--- a/profiles/base/shell/nushell.nix
+++ b/profiles/base/shell/nushell.nix
@@ -6,6 +6,8 @@
 }:
 with lib; let
   cfg = config.base.shell.nushell;
+  # User-specific secrets file from agenix, resolved at build time.
+  secretsFile = "/run/agenix/${config.home.username}-secrets";
 in {
   # Enabled by default — base modules are always-on.
   options.base.shell.nushell.enable = (mkEnableOption "enable nushell") // {default = true;};
@@ -42,15 +44,16 @@ in {
               | load-env
           }
 
-          # Load m3tam3re secrets from agenix. The secret file is Nushell code
+          # Load user-specific secrets from agenix. The secret file is Nushell code
           # containing a `load-env { ... }` block, not KEY=VALUE lines.
           # `source` resolves literal paths at parse time, so use `null` when absent.
-          const m3tam3re_secrets_file = if ("/run/agenix/m3tam3re-secrets" | path exists) {
-            "/run/agenix/m3tam3re-secrets"
+          # Path is resolved at Nix build time via config.home.username.
+          const user_secrets_file = if ("${secretsFile}" | path exists) {
+            "${secretsFile}"
           } else {
             null
           }
-          source $m3tam3re_secrets_file
+          source $user_secrets_file
       '';
 
       configFile.text = ''