profiles/base/shell/nushell.nix

@@ -6,6 +6,8 @@
 }:
 with lib; let
   cfg = config.base.shell.nushell;
+  # User-specific secrets file from agenix, resolved at build time.
+  secretsFile = "/run/agenix/${config.home.username}-secrets";
 in {
   # Enabled by default — base modules are always-on.
   options.base.shell.nushell.enable = (mkEnableOption "enable nushell") // {default = true;};
@@ -42,15 +44,16 @@ in {
               | load-env
           }
 
-          # Load m3tam3re secrets from agenix. The secret file is Nushell code
+          # Load user-specific secrets from agenix. The secret file is Nushell code
           # containing a `load-env { ... }` block, not KEY=VALUE lines.
           # `source` resolves literal paths at parse time, so use `null` when absent.
-          const m3tam3re_secrets_file = if ("/run/agenix/m3tam3re-secrets" | path exists) {
-            "/run/agenix/m3tam3re-secrets"
+          # Path is resolved at Nix build time via config.home.username.
+          const user_secrets_file = if ("${secretsFile}" | path exists) {
+            "${secretsFile}"
           } else {
             null
           }
-          source $m3tam3re_secrets_file
+          source $user_secrets_file
       '';
 
       configFile.text = ''