Working flake-based nixops config

lib/fudo/client/dns.nix

@@ -72,6 +72,7 @@ in {
   };
 
   config = mkIf cfg.enable {
+
     users.users = {
       "${cfg.user}" = {
         isSystemUser = true;

lib/fudo/hosts.nix

@@ -102,28 +102,44 @@ in {
 
     boot.tmpOnTmpfs = host-cfg.tmp-on-tmpfs;
 
-    fudo.secrets.host-secrets.${hostname} = let
-      keytab-file =
-        if (hasAttr hostname config.fudo.secrets.files.host-keytabs) then
-          config.fudo.secrets.files.host-keytabs.${hostname}
-        else null;
+    fudo = let
+      try-attr = attr: set: if (hasAttr attr set) then set.${attr} else null;
+
+      files = config.fudo.secrets.files;
+
+      keytab-file = try-attr hostname files.host-keytabs;
 
       build-private-key-file =
-        if (hasAttr hostname config.fudo.secrets.files.build-keypairs) then
-          config.fudo.secrets.files.build-keypairs.${hostname}.private-key
-        else null;
+        mapOptional
+          (keypair: keypair.private-key)
+          (try-attr hostname files.build-keypairs);
+
+      backplane-passwd-source = try-attr hostname files.backplane-passwords;
+
+      backplane-passwd-target = "/var/run/backplane/passwd";
     in {
-      host-keytab = mkIf (keytab-file != null) {
-        source-file = keytab-file;
-        target-file = "/etc/krb5.keytab";
-        user = "root";
+      secrets.host-secrets.${hostname} = {
+        host-keytab = mkIf (keytab-file != null) {
+          source-file = keytab-file;
+          target-file = "/etc/krb5.keytab";
+          user = "root";
+        };
+
+        build-private-key = mkIf (build-private-key-file != null) {
+          source-file = build-private-key-file;
+          target-file = "/var/run/nix-build/host.key";
+          user = "root";
+        };
+
+        backplane-passwd = mkIf (backplane-passwd-source != null) {
+          source-file = backplane-passwd-source;
+          target-file = backplane-passwd-target;
+          user = config.fudo.client.dns.user;
+        };
       };
 
-      build-private-key = mkIf (build-private-key-file != null) {
-        source-file = build-private-key-file;
-        target-file = "/var/run/nix-build/host.key";
-        user = "root";
-      };
+      client.dns.password-file = mkIf (backplane-passwd != null)
+        backplane-password-target;
     };
 
     programs.adb.enable = host-cfg.android-dev;

lib/instance.nix

@@ -27,6 +27,11 @@ in {
       description = "Site name of the current local host.";
     };
 
+    local-profile = mkOption {
+      type = str;
+      description = "Profile name of the current local host.";
+    };
+
     local-admins = mkOption {
       type = listOf str;
       description = "List of users who should have admin access to the local host.";