From 7da0463dceae68d3a321dc9a63631322fca4b719 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 30 Apr 2026 00:51:11 +0000
Subject: [PATCH 1/2] Initial plan


From 6512bf43566e9cf42a6c90b8f6e52392b0af81e0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 30 Apr 2026 00:52:17 +0000
Subject: [PATCH 2/2] fix: add set -euo pipefail and boot ordering to
 password-setup services

Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/2f9c39e8-d673-4314-bff7-28f1fffd48a0

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
---
 modules/credentials.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/modules/credentials.nix b/modules/credentials.nix
index 6aa81eb..9b18b1e 100644
--- a/modules/credentials.nix
+++ b/modules/credentials.nix
@@ -127,6 +127,7 @@ in
     };
     path = [ pkgs.shadow pkgs.coreutils ];
     script = ''
+      set -euo pipefail
       SECRET_FILE="/var/lib/secrets/root-password"
       if [ ! -f "$SECRET_FILE" ]; then
         mkdir -p /var/lib/secrets
@@ -158,12 +159,15 @@ in
   systemd.services.free-password-setup = {
     description = "Generate and set a random 'free' user password";
     wantedBy = [ "multi-user.target" ];
+    before = [ "display-manager.service" ];
+    after = [ "systemd-user-sessions.service" ];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
     };
     path = [ pkgs.shadow pkgs.coreutils ];
     script = ''
+      set -euo pipefail
       SECRET_FILE="/var/lib/secrets/free-password"
       PENDING_FILE="/var/lib/secrets/free-password-migration-pending"