3 files changed, 32 insertions, 1 deletions
diff --git a/modules/nixos/archetypes/default.nix b/modules/nixos/archetypes/default.nix
index dfdb4e4..0d11285 100644
--- a/modules/nixos/archetypes/default.nix
+++ b/modules/nixos/archetypes/default.nix
@@ -1,6 +1,6 @@
 {
   imports = [
-    ./server.nix
     ./personal.nix
+    ./server.nix
   ];
 }
diff --git a/modules/nixos/traits/default.nix b/modules/nixos/traits/default.nix
index 6816c56..1a69edb 100644
--- a/modules/nixos/traits/default.nix
+++ b/modules/nixos/traits/default.nix
@@ -7,6 +7,7 @@
     ./nvidia.nix
     ./secrets.nix
     ./tailscale.nix
+    ./users.nix
     ./zram.nix
   ];
 }
diff --git a/modules/nixos/traits/users.nix b/modules/nixos/traits/users.nix
new file mode 100644
index 0000000..2802901
--- /dev/null
+++ b/modules/nixos/traits/users.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  secretsDir,
+  ...
+}: let
+  cfg = config.traits.users;
+in {
+  options.traits.users = {
+    seth = {
+      manageSecrets =
+        lib.mkEnableOption "automatic secrets management"
+        // {
+          default = config.traits.secrets.enable;
+        };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.seth.enable && cfg.seth.manageSecrets) {
+      age.secrets = {
+        sethPassword.file = secretsDir + "/sethPassword.age";
+      };
+
+      users.users.seth = {
+        hashedPasswordFile = lib.mkDefault config.age.secrets.sethPassword.path;
+      };
+    })
+  ];
+}