i've locked myself out

hosts/sarien/users.nix

@@ -1,15 +1,24 @@
-{pkgs, ...}: {
+{
+  inputs,
+  config,
+  pkgs,
+  ...
+}: let
+  sopSec = config.sops.secrets;
+  secrets = inputs.mysecrets;
+in {
   nix.settings.trusted-users = ["user"];
+  users.mutableUsers = false;
   users.users = {
     user = {
+      hashedPasswordFile = sopSec."user-password-hashed".path;
       isNormalUser = true;
       extraGroups = ["wheel" "video" "libvirtd" "dialout"];
       shell = pkgs.fish;
+      openssh.authorizedKeys.keyFiles = [
+        "${secrets}/ssh/id_ed25519_sarien_user.pub"
+        "${secrets}/ssh/id_ed25519_eldrid_user.pub"
+      ];
     };
-    # work = {
-    #   isNormalUser = true;
-    #   extraGroups = ["video"];
-    #   shell = pkgs.nushell;
-    # };
   };
 }