refactor(secrets): simplify home manager secrets

home/modules/secrets/default.nix

@@ -2,24 +2,108 @@
   config,
   lib,
   pkgs,
+  inputs,
+  lib',
+  osConfig ? null,
   ...
 }:
+
+let
+  cfg = config.secrets;
+  sops = lib'.sopsAvailability config osConfig;
+  standalone = !sops.osAvailable;
+
+  sopsDir = "${toString inputs.nix-secrets}/secrets";
+in
 {
+  imports = [ ./vault.nix ];
+
   options.secrets = {
     enable = lib.mkEnableOption "secrets";
 
     vault = {
       enable = lib.mkEnableOption "vault CLI";
     };
+
+    files = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+      default = { };
+      example = {
+        taskwarrior = [ "sync-server-url" ];
+      };
+      description = "Keys to decrypt, grouped by the sops file that holds them.";
+    };
+
+    templates = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            path = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "Where to render the template, relative to the home directory.";
+            };
+            content = lib.mkOption {
+              type = lib.types.str;
+              description = "Template body; interpolate keys with `config.sops.placeholder`.";
+            };
+          };
+        }
+      );
+      default = { };
+      description = "Secret-bearing templates to render; declare their keys in `secrets.files`.";
+    };
+
+    path = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      readOnly = true;
+      description = "Decrypted secret paths, keyed by `<file>/<key>`.";
+    };
+
+    templatePath = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      readOnly = true;
+      description = "Rendered template paths, keyed by template name.";
+    };
   };
 
-  imports = [ ./vault.nix ];
+  config = lib.mkMerge [
+    {
+      secrets.path = lib.optionalAttrs sops.available (
+        lib.mapAttrs (_: secret: secret.path) sops.secrets
+      );
 
-  config = lib.mkIf config.secrets.enable {
-    home.packages = with pkgs; [
-      age
-      age-plugin-yubikey
-      sops
-    ];
-  };
+      secrets.templatePath = lib.optionalAttrs sops.available (
+        lib.mapAttrs (_: template: template.path) sops.templates
+      );
+    }
+    (lib.mkIf cfg.enable (
+      lib.optionalAttrs standalone {
+        sops = {
+          secrets = lib'.mkSopsSecrets sopsDir null cfg.files;
+
+          templates = lib.mapAttrs (
+            _: t:
+            {
+              inherit (t) content;
+            }
+            // lib.optionalAttrs (t.path != null) {
+              path = "${config.home.homeDirectory}/${t.path}";
+            }
+          ) cfg.templates;
+        };
+      }
+      // {
+        home.packages = [
+          pkgs.age
+          pkgs.age-plugin-yubikey
+          pkgs.sops
+        ];
+
+        warnings = lib.optional (
+          !sops.available && (cfg.files != { } || cfg.templates != { })
+        ) "secrets are declared, but sops is unavailable; they will not be decrypted or rendered.";
+      }
+    ))
+  ];
 }