alexion
dcc03155a2
The procedure was built around a login password set by hand through nixos-enter, a step that no longer exists now that the password arrives as a decrypted secret. Rather than patch around it, revise the document: the LUKS passphrase is named as the only hand-entered secret, and identity provisioning moves ahead of first boot, since there is no fallback credential to get in with if decryption fails. Cover the three procedures the install alone did not: provisioning a running host live, the editing workflow and what it needs the admin identity for, and recovery from the live ISO.