too complicated

hosts/blade/default.nix

@@ -15,25 +15,5 @@
   networking.interfaces.eth0.wakeOnLan.enable = true;
 
   # ── NetBird zero-trust VPN ─────────────────────────────────
-  services.netbird = {
+  services.netbird.enable = true;
-    enable = true;
-    login = {
-      enable = true;
-      setupKeyFile = "/run/secrets/netbird-setup-key";
-    };
-  };
-
-  # Decrypt the NetBird setup key from SOPS secrets before netbird starts
-  system.activationScripts.netbird-setup-key = {
-    text = ''
-      mkdir -p /run/secrets
-      ${pkgs.sops}/bin/sops \
-        --decrypt \
-        --extract '["netbird_setup_key"]' \
-        ${./secrets.yaml} \
-        > /run/secrets/netbird-setup-key
-      chmod 600 /run/secrets/netbird-setup-key
-    '';
-    deps = [ "etc" ];
-  };
 }