fix: restore local-session HM routing and update shared sops key path

.gitignore

@@ -2,3 +2,5 @@
 .claude/
 .codex/
 .opencode/
+
+result/

modules/bundles.nix

@@ -24,6 +24,21 @@
     ];
   };
 
+  lux.bundles._.local-session-user = {
+    includes = with lux; [
+      nix
+      niri
+      clipboard
+      local-apps
+      pinentry
+      qbittorrent-client
+      vicinae
+      xdg
+      theme
+      noctalia
+    ];
+  };
+
   lux.bundles._.development = {
     includes = with lux; [
       git

modules/hosts/polaris/default.nix

@@ -5,6 +5,7 @@
 
     provides.kiri = {
       includes = with lux; [
+        bundles._.local-session-user
         bitwarden
         email
         pim

modules/hosts/zenith/default.nix

@@ -5,6 +5,7 @@
 
     provides.kiri = {
       includes = with lux; [
+        bundles._.local-session-user
         bitwarden
         email
         pim

modules/infra.nix

@@ -1,6 +1,6 @@
 let
   serviceDomain = "jelles.net";
-  adminKeyPath = "/var/lib/sops-nix/admin-key.txt";
+  adminKeyPath = "/var/lib/sops/keys.txt";
 
   sharedIdentity = {
     realName = "Jelle Spreeuwenberg";

modules/secrets/sops.nix

@@ -8,6 +8,7 @@ in
       { host, ... }:
       let
         missingAdminUsers = lib.filter (userName: !(builtins.hasAttr userName host.users)) host.sopsAdminKeyUsers;
+        hasSharedAdminKey = host.sopsAdminKeyPath != null && host.sopsAdminKeyUsers != [ ];
         adminKeyDir = if host.sopsAdminKeyPath == null then null else builtins.dirOf host.sopsAdminKeyPath;
       in
       {
@@ -27,7 +28,7 @@ in
                 };
           };
 
-          users.groups = lib.optionalAttrs (host.sopsAdminKeyUsers != [ ]) {
+          users.groups = lib.optionalAttrs hasSharedAdminKey {
             ${sopsReadersGroup} = { };
           };
 
@@ -35,8 +36,9 @@ in
             extraGroups = [ sopsReadersGroup ];
           });
 
-          systemd.tmpfiles.rules = lib.optionals (adminKeyDir != null) [
+          systemd.tmpfiles.rules = lib.optionals hasSharedAdminKey [
             "d ${adminKeyDir} 0750 root ${sopsReadersGroup} -"
+            "z ${host.sopsAdminKeyPath} 0640 root ${sopsReadersGroup} -"
           ];
 
           assertions = [

result

@@ -0,0 +1 @@
+/nix/store/f04b5bwj62pi05mzg8lrrmq6wfr9i3hd-nixos-system-polaris-26.05.20260415.566acc0