fix: correct sd-image module to nixosModules.sd-image

This reverts commit 5202bc1fcb.

flake.nix

@@ -12,18 +12,23 @@
       url = "git+https://git.lix.systems/lix-project/lix?ref=main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    # uConsole CM5 — pinned nixpkgs for kernel patch compatibility
+    nixpkgs-uconsole.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixos-uconsole = {
-      url = "github:nixos-uconsole/nixos-uconsole";
+      url = "github:nixos-uconsole/nixos-uconsole/v1.1.0";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-uconsole";
+      inputs.nixos-raspberrypi.follows = "nixos-raspberrypi";
     };
     nixos-raspberrypi = {
-      url = "github:nvmd/nixos-raspberrypi/v1.20260317.0";
+      url = "github:gortium/nixos-raspberrypi/cm5-cross-v1";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-uconsole";
-    };
-    self.submodules = true;
   };
+};
 
-  outputs = { self, nixpkgs, agenix, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs:
+  outputs = { self, nixpkgs, agenix, lix
+            , nixpkgs-uconsole, nixos-uconsole, nixos-raspberrypi
+            , ... }@inputs:
     let
       system = "x86_64-linux";
       keys = import ./lib/keys.nix;
@@ -34,7 +39,7 @@
           "/etc/ssh/ssh_host_ed25519_key"
           "/root/.age/bootstrap.key" ];
       };
-      overlays = [ agenix.overlays.default (import ./overlays/reticulum.nix) ];
+      overlays = [ agenix.overlays.default ];
       pkgs = import nixpkgs {
         inherit system overlays;
         config.allowUnfree = true;
@@ -89,22 +94,77 @@
             ];
           };
 
-          uConsole = nixos-raspberrypi.lib.nixosSystem {
+          # ============================================================
-            specialArgs = { inherit self keys paths inputs nixos-raspberrypi; };
+          # uConsole CM5 — cross-compilé (build sur x86_64, run sur ARM)
+          # Approche incrémentale pour fixer l'écran
+          # ============================================================
+          uconsole-cm5 = nixpkgs-uconsole.lib.nixosSystem {
+            system = "aarch64-linux";
+            specialArgs = {
+              inherit self keys paths inputs;
+              nixos-raspberrypi = nixos-raspberrypi;
+              isCM4 = false;
+            };
             modules = [
               {
-                nixpkgs.overlays = overlays;
+                # Cross-compile : build sur x86_64, run sur aarch64
-                nixpkgs.config.allowUnfree = true;
+                nixpkgs.buildPlatform = "x86_64-linux";
                 nixpkgs.hostPlatform = "aarch64-linux";
-                nix.package = lix.packages."aarch64-linux".default;
+                nixpkgs.config.allowUnfree = true;
+                boot.loader.raspberry-pi.bootloader = "kernel";
               }
+              # nixos-raspberrypi — pkgs.rpi + overlays standardisés
+              nixos-raspberrypi.nixosModules.nixpkgs-rpi
               nixos-raspberrypi.nixosModules.raspberry-pi-5.base
-              nixos-uconsole.nixosModules.uconsole-cm5
+              nixos-raspberrypi.lib.inject-overlays
-              ./hosts/uConsole/configuration.nix
+              nixos-raspberrypi.lib.inject-overlays-global
-              ./hosts/uConsole/hardware-configuration.nix
+              # nixos-uconsole CM5 modules
+              nixos-uconsole.nixosModules.kernel
+              (nixos-uconsole.nixosModules.cm { lib = nixpkgs-uconsole.lib; isCM4 = false; })
+              nixos-uconsole.nixosModules.base
+              # Lix cross-compilé (lix.packages.aarch64-linux est natif → QEMU)
+              ({ config, lib, pkgs, inputs, ... }: let
+                lix-cross = import inputs.nixpkgs-uconsole {
+                  localSystem = { system = "x86_64-linux"; };
+                  crossSystem = { system = "aarch64-linux"; };
+                  overlays = [ inputs.lix.overlays.default ];
+                };
+              in { nix.package = lix-cross.lix; })
+              # agenix
+              agenix.nixosModules.default
+              # Notre config
+              ./hosts/uconsole-cm5/configuration.nix
+              ./hosts/uconsole-cm5/hardware-configuration.nix
             ];
           };
         };
         devShells.${system}.default = devShell;
+        packages.${system} = {
+          # Image SD flashable pour uConsole CM5 (SSH + WiFi + clés)
+          # Usage : dd if=result of=/dev/sda bs=4M status=progress conv=fsync
+          uconsole-cm5-image = (nixos-raspberrypi.lib.nixosSystem {
+            system = "aarch64-linux";
+            specialArgs = {
+              inherit self keys inputs;
+              nixos-raspberrypi = nixos-raspberrypi;
+              isCM4 = false;
+            };
+            modules = [
+              {
+                nixpkgs.buildPlatform = system;
+                nixpkgs.hostPlatform = "aarch64-linux";
+              }
+              nixos-raspberrypi.nixosModules.nixpkgs-rpi
+              nixos-raspberrypi.nixosModules.raspberry-pi-5.base
+              nixos-raspberrypi.lib.inject-overlays-global
+              nixos-raspberrypi.nixosModules.sd-image
+              nixos-uconsole.nixosModules.kernel
+              (nixos-uconsole.nixosModules.cm { lib = nixpkgs-uconsole.lib; isCM4 = false; })
+              nixos-uconsole.nixosModules.base
+              agenix.nixosModules.default
+              ./hosts/uconsole-cm5/configuration.nix
+            ];
+          }).config.system.build.sdImage;
+        };
       };
 }

hosts/lazyworkhorse/configuration.nix

@@ -9,7 +9,7 @@
   hoardingcow-mount.enable = true;
 
   # Flakesss
-  nix.settings.experimental-features = [ "nix-command" "flakes" "flake-self-attrs" ];
+  nix.settings.experimental-features = [ "nix-command" "flakes" "flake-self-attrs" "ca-derivations" ];
   nix.settings.trusted-users = [ "root" "gortium" ];
 
   # Garbage collection

hosts/lazyworkhorse/hyperspace-commit-msg.txt

@@ -0,0 +1,12 @@
+feat: add Hyperspace Pods NixOS module
+
+Create modules/nixos/services/hyperspace.nix for the Hyperspace Pods
+P2P AI cluster agent. Registered in flake.nix under lazyworkhorse.
+
+- Fetches CLI binary v5.45.30 via fetchurl with SRI hash verification
+- Systemd system service: auto profile, configurable api port 8080,
+  ai-worker user, GPU device access (kfd+dri), SupplementaryGroups
+  for video+render groups, service hardening
+- Firewall: TCP 4001 libp2p, 30301 chain, 8080 API; UDP 4001 libp2p
+- AMD MI50 ROCm via HSA_OVERRIDE_GFX_VERSION=9.0.6
+- Adds video+render groups to ai-worker for persistent GPU access

hosts/lazyworkhorse/hyperspace.nix

@@ -0,0 +1,134 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.hyperspace;
+
+  hyperspacePkg = pkgs.stdenv.mkDerivation {
+    name = "hyperspace-pods-${cfg.version}";
+    src = pkgs.fetchurl {
+      url = "https://github.com/hyperspaceai/aios-cli/releases/download/v${cfg.version}/aios-cli-x86_64-unknown-linux-gnu.tar.gz";
+      hash = cfg.packageHash;
+    };
+    sourceRoot = ".";
+    installPhase = ''
+      mkdir -p $out/libexec $out/bin
+      cp -r * $out/libexec/
+      chmod +x $out/libexec/aios-cli
+      ln -s $out/libexec/aios-cli $out/bin/hyperspace
+    '';
+  };
+in {
+  options.services.hyperspace = {
+    enable = lib.mkEnableOption "Hyperspace Pods P2P AI cluster agent";
+
+    version = lib.mkOption {
+      type = lib.types.str;
+      default = "5.45.30";
+      description = "Hyperspace CLI version to download.";
+    };
+
+    packageHash = lib.mkOption {
+      type = lib.types.str;
+      default = "sha256-f6fJ8t3exqtYwUD5j+WvD+Hm0oN/Eef0X+R9Rj23dE0=";
+      description = ''
+        SRI hash of the hyperspace release tarball (sha256-<base64>).
+        Must be updated when version changes. Generate with:
+        nix store prefetch-file --hash-algo sha256 \\
+          https://github.com/hyperspaceai/aios-cli/releases/download/v{version}/aios-cli-x86_64-unknown-linux-gnu.tar.gz
+      '';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "ai-worker";
+      description = "System user to run the Hyperspace agent.";
+    };
+
+    apiPort = lib.mkOption {
+      type = lib.types.port;
+      default = 8080;
+      description = "OpenAI-compatible API port (configurable via --api-port).";
+    };
+
+    profile = lib.mkOption {
+      type = lib.types.str;
+      default = "auto";
+      description = ''
+        Agent profile. Options: auto (auto-detect hardware), full (all capabilities),
+        inference (GPU inference only), embedding (CPU embedding only),
+        relay (lightweight relay), storage (storage + memory).
+      '';
+    };
+
+    autoStart = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Start the agent automatically on boot.";
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Open P2P mesh (4001 TCP+UDP, 30301 TCP) and API port in the firewall.";
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra arguments to pass to 'hyperspace start'.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.hyperspace = {
+      description = "Hyperspace Pods P2P AI Cluster Agent";
+      after = [ "network.target" "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = lib.mkIf cfg.autoStart [ "multi-user.target" ];
+
+      path = with pkgs; [ bash coreutils ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.user;
+        WorkingDirectory = "${hyperspacePkg}/libexec";
+        ExecStart = "${hyperspacePkg}/bin/hyperspace start --profile ${cfg.profile} --api-port ${toString cfg.apiPort} ${lib.escapeShellArgs cfg.extraArgs}";
+        Restart = "on-failure";
+        RestartSec = 5;
+
+        # AMD MI50 (ROCm) device access
+        DeviceAllow = [ "/dev/kfd rw" "/dev/dri rw" ];
+
+        # Supplementary groups for GPU/accelerator access
+        SupplementaryGroups = [ "video" "render" ];
+
+        # Hardening
+        NoNewPrivileges = true;
+        ProtectHome = "tmpfs";
+        ProtectSystem = "strict";
+        PrivateTmp = true;
+        PrivateDevices = false; # Needs /dev/kfd and /dev/dri
+      };
+
+      environment = {
+        HSA_OVERRIDE_GFX_VERSION = "9.0.6";
+        HOME = "/home/${cfg.user}";
+      };
+    };
+
+    # Firewall ports for P2P mesh (libp2p 4001, chain 30301) and API
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 4001 30301 cfg.apiPort ];
+    networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ 4001 ];
+
+    # Add GPU/accelerator groups to the service user (persistent beyond service restarts)
+    users.users = lib.mkIf (cfg.user == "ai-worker") {
+      ai-worker = {
+        extraGroups = [ "video" "render" ];
+      };
+    };
+
+    # ROCm override for AMD MI50 (gfx906) compatibility
+    environment.variables.HSA_OVERRIDE_GFX_VERSION = "9.0.6";
+  };
+}

hosts/uConsole/configuration.nix

@@ -1,167 +0,0 @@
-{ config, lib, pkgs, paths, self, ... }:
-
-{
-  # Basic Host Info
-  networking.hostName = "uConsole";
-  time.timeZone = "America/Montreal";
-  i18n.defaultLocale = "en_CA.UTF-8";
-
-  # System State
-  system.stateVersion = "25.05";
-
-  # Boot & Hardware (uconsole-cm5 module handles boot.loader)
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  # Networking
-  networking.networkmanager.enable = true;
-  services.openssh = {
-    enable = true;
-    settings.PermitRootLogin = "prohibit-password";
-    settings.PasswordAuthentication = false;
-  };
-
-  # User
-  users.users.gortium = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "networkmanager" "video" "dialout" "kismet" ];
-    openssh.authorizedKeys.keys = [
-      keys.users.gortium.main
-      keys.users.gortium.gitea
-    ];
-  };
-  security.sudo.extraRules = [
-    {
-      users = [ "gortium" ];
-      commands = [
-        {
-          command = "ALL";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
-
-  # ============================================================
-  # Package groups
-  # ============================================================
-
-  environment.systemPackages = with pkgs; [
-    # ===== Base =====
-    emacs-pgtk
-    git
-    ripgrep
-    fd
-    htop
-    tmux
-    neovim
-
-    # ===== HAM Radio =====
-    js8call
-    wsjtx
-    fldigi
-    pat                        # Winlink client
-    direwolf                   # AX.25 packet modem
-    chirp                      # Radio programming tool
-    hamlib                     # Ham radio control libraries
-    trustedqsl                 # Logbook of the World (LoTW)
-
-    # ===== SDR / RF =====
-    sdrpp                      # SDR++ spectrum analyzer
-    gqrx                       # SDR receiver GUI
-    rtl-sdr                    # RTL-SDR drivers & utilities
-    inspectrum                # Offline signal analysis
-    soapysdr-with-plugins      # SoapySDR + hardware support plugins
-
-    # ===== Mesh / LoRa =====
-    meshtastic                 # Python CLI for Meshtastic devices
-    reticulumStack             # Reticulum Network Stack (rnsd, rnsh, rncp, rnx, rnpath, etc.)
-    lxmf                       # LXMF messaging protocol
-    nomadnet                   # Nomad Network client
-
-    # ===== Security =====
-    nmap
-    aircrack-ng
-    kismet                     # Wi-Fi monitor / IDS
-    bettercap                  # MITM/network attack framework
-    wireshark                  # Packet analyzer
-    hashcat                    # GPU password cracker
-    john                       # John the Ripper
-    sqlmap                     # SQL injection tool
-
-    # ===== GPS / Maps =====
-    foxtrotgps
-    viking                     # GPS map editor
-    gpsbabel                   # GPS data conversion
-  ];
-
-  # Packages noted but not in unstable nixpkgs:
-  #   - metasploit: unfree; install manually via Git clone
-  #   - burpsuite: unfree Java app (Community Edition available for download)
-  #   - sidechannel: not a distinct PyPI package; functionality covered by
-  #     the Reticulum stack. For LXMF GUI client, install Sideband manually
-  #     from github.com/markqvist/Sideband
-
-  # ============================================================
-  # Reticulum Service (rnsd)
-  # ============================================================
-  systemd.services.rnsd = {
-    description = "Reticulum Network Stack Daemon";
-    after = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      User = "gortium";
-      Group = "gortium";
-      ExecStart = "${pkgs.reticulumStack}/bin/rnsd";
-      Restart = "always";
-      RestartSec = "10s";
-      LimitNOFILE = 65536;
-    };
-  };
-
-  # ============================================================
-  # Kismet Service (Wi-Fi monitoring / mesh node)
-  # ============================================================
-  systemd.services.kismet = {
-    description = "Kismet Wi-Fi Monitor & IDS";
-    after = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      User = "gortium";
-      Group = "kismet";
-      ExecStart = "${pkgs.kismet}/bin/kismet -c wlan0 --log-base=/home/gortium/kismet_logs --no-nc-ui";
-      Restart = "always";
-      RestartSec = "10s";
-    };
-  };
-
-  # ============================================================
-  # Kernel modules for SDR and radio
-  # ============================================================
-  boot.kernelModules = [
-    "88x2bu"          # Realtek 8812/8821BU USB WiFi (common adapter)
-    "rtl8xxxu"        # RTL8188/8192/8723 USB WiFi
-    "rtl2832_sdr"     # RTL-SDR kernel module
-    "dvb_usb_rtl28xxu" # RTL-SDR DVB-T
-  ];
-
-  boot.blacklistedKernelModules = [ ];
-
-  # ============================================================
-  # Extra udev rules for SDR and HAM radio devices
-  # ============================================================
-  services.udev.packages = with pkgs; [ rtl-sdr ];
-
-  # ============================================================
-  # Enable IPv6 for Reticulum mesh
-  # ============================================================
-  networking.enableIPv6 = true;
-
-  # ============================================================
-  # Firewall: open ports for Reticulum (optional)
-  # ============================================================
-  networking.firewall.allowedTCPPorts = [ 22 ]; # SSH only
-  networking.firewall.allowedUDPPorts = [ ];
-  # Reticulum uses its own encryption and doesn't need open ports
-  # for basic mesh operations (peer-to-peer discovery).
-  # For TCP interfaces, open additional ports as needed.
-}

hosts/uconsole-cm5/configuration.nix

@@ -0,0 +1,28 @@
+{ config, lib, pkgs, keys, ... }:
+
+{
+  networking.hostName = "uConsole";
+  time.timeZone = "America/Montreal";
+  i18n.defaultLocale = "en_CA.UTF-8";
+  system.stateVersion = "25.11";
+
+  # SSH — root access avec clés gortium + ai-worker
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = lib.mkForce "prohibit-password";
+      PasswordAuthentication = lib.mkForce false;
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = with keys; [
+    users.gortium.main
+    users.ai-worker.main
+  ];
+
+  # WiFi via NetworkManager + secret agenix
+  networking.networkmanager.enable = true;
+
+  # Firmware
+  hardware.enableRedistributableFirmware = true;
+}

hosts/uconsole-cm5/hardware-configuration.nix

@@ -1,23 +1,27 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" "sdhci_pci" "nvme" ];
   boot.initrd.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  # uConsole CM5 uses NVMe or eMMC for boot storage
+  # SD card partitions (nixos-uconsole layout)
-  # The uconsole-cm5 module sets up /boot/firmware and default /
+  fileSystems."/" = {
-  # Override device label here if using different storage
+    device = "/dev/disk/by-label/NIXOS_SD";
-  fileSystems."/" = lib.mkDefault {
-    device = "/dev/disk/by-label/NIXOS_UCM5";
     fsType = "ext4";
     options = [ "noatime" ];
   };
 
+  fileSystems."/boot/firmware" = {
+    device = "/dev/disk/by-label/FIRMWARE";
+    fsType = "vfat";
+    options = [ "fmask=0022" "dmask=0022" ];
+  };
+
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";

overlays/reticulum.nix

@@ -1,77 +0,0 @@
-final: prev: let
-  python3 = final.python3;
-  pyPkgs = python3.pkgs;
-in {
-  reticulumStack = python3.pkgs.buildPythonApplication rec {
-    pname = "reticulum";
-    version = "1.2.9";
-    src = pyPkgs.fetchPypi {
-      pname = "rns";
-      inherit version;
-      sha256 = "554814231c237b9caacf8df669312e57dd7d3f84b6d4810125087d1a79a75d75";
-    };
-    propagatedBuildInputs = with pyPkgs; [ cryptography pyserial ];
-    doCheck = false;
-    pythonImportsCheck = [ "RNS" ];
-    meta = with final.lib; {
-      description = "Self-configuring, encrypted and resilient mesh networking stack";
-      homepage = "https://reticulum.network/";
-      license = licenses.mit;
-      platforms = platforms.linux;
-    };
-  };
-
-  lxmf = python3.pkgs.buildPythonApplication rec {
-    pname = "lxmf";
-    version = "0.9.8";
-    src = pyPkgs.fetchPypi {
-      inherit pname version;
-      sha256 = "30f39f3a975a049c12ee2cfceb3261d24cb5adec881c6821f7354464b3f3650c";
-    };
-    propagatedBuildInputs = [ final.reticulumStack ];
-    doCheck = false;
-    pythonImportsCheck = [ "LXMF" ];
-    meta = with final.lib; {
-      description = "Lightweight Extensible Message Format for Reticulum";
-      homepage = "https://github.com/markqvist/lxmf";
-      license = licenses.mit;
-      platforms = platforms.linux;
-    };
-  };
-
-  nomadnet = python3.pkgs.buildPythonApplication rec {
-    pname = "nomadnet";
-    version = "1.1.1";
-    src = pyPkgs.fetchPypi {
-      inherit pname version;
-      sha256 = "fa13b64a10e75b705a58024815ab72451700aa726af96d415ba99dec28dfc40a";
-    };
-    propagatedBuildInputs = with pyPkgs; [ final.reticulumStack final.lxmf urwid qrcode ];
-    doCheck = false;
-    pythonImportsCheck = [ "nomadnet" ];
-    meta = with final.lib; {
-      description = "Nomad Network — resilient mesh communications platform";
-      homepage = "https://github.com/markqvist/NomadNet";
-      license = licenses.mit;
-      platforms = platforms.linux;
-    };
-  };
-
-  rnsh = python3.pkgs.buildPythonApplication rec {
-    pname = "rnsh";
-    version = "0.1.7";
-    src = pyPkgs.fetchPypi {
-      inherit pname version;
-      sha256 = "9cb72f25abb1c6d300f8014b264184ff78f592fe88e36094938012990b797c93";
-    };
-    propagatedBuildInputs = [ final.reticulumStack ];
-    doCheck = false;
-    pythonImportsCheck = [ "rnsh" ];
-    meta = with final.lib; {
-      description = "Remote shell over Reticulum";
-      homepage = "https://github.com/acehoss/rnsh";
-      license = licenses.mit;
-      platforms = platforms.linux;
-    };
-  };
-}

secrets/home_wifi.age

@@ -0,0 +1,10 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSAycE1Y
+YmMvUWZpK2VKQVlqaHFtaERBRGROcFIyL0d6dEVRQmFxLzlqdFZNCkYxWkNIUXRZ
+V0dQOG4zY3U3Nk1JelBtY0cwUGdxaEI3dmZaVTZId04rVTQKLT4geV1cZC4wMnst
+Z3JlYXNlIDYgOG1IME1xCkQ0RGN1NU1FUWk0Y1RmamNEY0tJWmFQNGdoMkROcGVy
+aU5UYVFobVRLMVVUQ1JicUM2c0tSVzRQdEZ0VE5YamQKZUxPeVpLWDZJR0hqemdD
+cmkyUUdFZEZKZjBDNGhmNFR6bVUKLS0tIDRQUGR5RGI5UEhGNk5EQWw4dFk0R01k
+TUJWOFpleXBUajFPckFmem52cGsKHzn+QnuYLI2NEh5WWZQHrNuvVzYk+kVjsAsn
+KNS2dHjvadAopVY2Gypldf1p2RRtmgZkDHaPlNzv5Hk=
+-----END AGE ENCRYPTED FILE-----

secrets/secrets.nix

@@ -11,4 +11,5 @@ in
   "lazyworkhorse_host_ssh_key.age".publicKeys = authorizedKeys;
   "n8n_ssh_key.age".publicKeys = authorizedKeys;
   "openclaw_gateway_token.age".publicKeys = authorizedKeys;
+  "home_wifi.age".publicKeys = authorizedKeys;
 }