docs(nix): clarify guest secret rule

2026-10-20 04:37:41 -04:00
parent 20c8e57a63
commit 7c4cefdb26
1 changed files with 2 additions and 2 deletions
--- a/src/skills/style/nix/rules/dotfiles.md
+++ b/src/skills/style/nix/rules/dotfiles.md
@@ -34,8 +34,8 @@ Host configuration provides deployment-specific values.
 ### Rule
-Set the secret's owner to a host user before SOPS decrypts it.
+A host user owns each guest secret before SOPS decrypts it.
-Give the guest service group read access through a read-only bind mount.
+Each guest service group accesses its secrets through a read-only bind mount.
 ### Rationale