refactor: ponytail audit

modules/flake-parts.nix

@@ -7,15 +7,10 @@
 let
   mkHost =
     name: machine:
-    { pkgs, ... }:
+    hostArgs@{ pkgs, ... }:
     let
       account = config.facts.account;
-      machineFacts = machine // {
-        inherit name;
-      };
-      services = lib.mapAttrs (_: service: {
-        inherit (service) scheme domain;
-      }) config.facts.services;
+      services = lib.mapAttrs (_: service: removeAttrs service [ "origin" ]) config.facts.services;
     in
     {
       imports = [
@@ -30,7 +25,9 @@ let
           topology
           ;
         inherit services;
-        machine = machineFacts;
+        machine = machine // {
+          inherit name;
+        };
       };
 
       networking.hostName = name;
@@ -38,9 +35,12 @@ let
 
       programs.zsh.enable = true;
 
+      sops.secrets.hashed-password.neededForUsers = true;
+
       users.users.${account.name} = {
         isNormalUser = true;
         home = account.homeDirectory;
+        hashedPasswordFile = hostArgs.config.sops.secrets.hashed-password.path;
         extraGroups = [
           "wheel"
           "networkmanager"