1{den, ...}: {
 2  den.schema.host.includes = [
 3    den.batteries.hostname
 4
 5    ({host, ...}: {
 6      name = "${host.name}/root/password";
 7
 8      nixos = {
 9        config,
10        lib,
11        ...
12      }:
13        lib.optionalAttrs (host.rootHashedPasswordFileAged != null) (let
14          secretName = "hashed-password-user-root";
15        in {
16          users.users.root.hashedPasswordFile = config.vaultix.secrets.${secretName}.path;
17          vaultix.secrets.${secretName}.file = host.rootHashedPasswordFileAged;
18          vaultix.beforeUserborn = [secretName];
19        });
20    })
21  ];
22}