refactor(secrets): simplify home manager secrets

home/modules/ai-tools/opencode.nix

@@ -2,25 +2,18 @@
   config,
   lib,
   pkgs,
-  lib',
-  osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
-  sops = lib'.sopsAvailability config osConfig;
-  standalone = osConfig == null;
+  authReady = config.secrets.templatePath ? "opencode/auth.json";
 in
 {
-  config = lib.mkIf config.ai-tools.opencode.enable (
-    lib.optionalAttrs standalone {
-      sops = {
-        secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-          opencode = [ "api-key" ];
-        };
-        templates."opencode/auth.json" = {
-          path = "${config.home.homeDirectory}/.local/share/opencode/auth.json";
+  config = lib.mkIf config.ai-tools.opencode.enable {
+    secrets.files.opencode = [ "api-key" ];
+
+    secrets.templates."opencode/auth.json" = {
+      path = ".local/share/opencode/auth.json";
       content = builtins.toJSON {
         zai-coding-plan = {
           type = "api";
@@ -28,12 +21,10 @@ in
         };
       };
     };
-      };
-    }
-    // {
+
     warnings =
-        lib.optional (!sops.available)
-          "opencode is enabled, but sops templates are not available. the opencode API key will not be configured.";
+      lib.optional (!authReady)
+        "opencode is enabled but its auth template is unavailable. the opencode API key will not be configured.";
 
     home.packages = [ pkgs.opencode ];
     home.file.".config/opencode/opencode.json".text = builtins.toJSON {
@@ -57,6 +48,5 @@ in
       };
       plugin = [ "@mohak34/opencode-notifier@latest" ];
     };
-    }
-  );
+  };
 }

home/modules/anki/default.nix

@@ -2,33 +2,25 @@
   config,
   lib,
   pkgs,
-  lib',
-  osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
   cfg = config.anki;
-  sops = lib'.sopsAvailability config osConfig;
-  standalone = osConfig == null;
+  syncReady = config.secrets.path ? "anki/sync-user" && config.secrets.path ? "anki/sync-key";
 in
 {
   options.anki.enable = lib.mkEnableOption "Anki";
 
-  config = lib.mkIf cfg.enable (
-    lib.optionalAttrs standalone {
-      sops.secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-        anki = [
+  config = lib.mkIf cfg.enable {
+    secrets.files.anki = [
       "sync-user"
       "sync-key"
     ];
-      };
-    }
-    // {
+
     warnings = lib.optional (
-        !sops.available
-      ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
+      !syncReady
+    ) "anki is enabled but its secrets are unavailable. anki sync will not be configured.";
 
     programs.anki = {
       enable = true;
@@ -48,14 +40,13 @@ in
         puppy-reinforcement
         review-heatmap
       ];
-        profiles."User 1".sync = lib.mkIf sops.available {
-          usernameFile = "${sops.secrets."anki/sync-user".path}";
-          keyFile = "${sops.secrets."anki/sync-key".path}";
+      profiles."User 1".sync = lib.mkIf syncReady {
+        usernameFile = config.secrets.path."anki/sync-user";
+        keyFile = config.secrets.path."anki/sync-key";
       };
     };
 
     # allow Anki to write prefs
     home.file."${config.xdg.dataHome}/Anki2/prefs21.db".enable = lib.mkForce false;
-    }
-  );
+  };
 }

home/modules/git/default.nix

@@ -1,22 +1,24 @@
 {
   config,
-  inputs,
   lib,
-  lib',
-  osConfig ? null,
   ...
 }:
 
 let
   cfg = config.git;
-  sops = lib'.sopsAvailability config osConfig;
-  standalone = osConfig == null;
+  identities = [
+    "personal"
+    "work"
+  ];
 
-  personalEmail = sops.templates.".gitconfig.email".path;
-  workEmail = sops.templates.".gitconfig.work.email".path;
+  emailTemplate = key: ".gitconfig.${key}.email";
+  emailInclude =
+    key:
+    lib.optionalAttrs (config.secrets.templatePath ? ${emailTemplate key}) {
+      include.path = config.secrets.templatePath.${emailTemplate key};
+    };
 
-  workSettings = {
-    include.path = workEmail;
+  workSettings = emailInclude "work" // {
     core.longpaths = true;
     user = {
       name = "Hektor Misplon";
@@ -47,29 +49,19 @@ in
     ./gitlab.nix
   ];
 
-  config = lib.mkIf cfg.enable (
-    lib.optionalAttrs standalone {
-      sops = {
-        secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-          email = [
-            "personal"
-            "work"
-          ];
-        };
+  config = lib.mkIf cfg.enable {
+    secrets.files.email = identities;
 
-        templates = {
-          ".gitconfig.email".content = ''
+    secrets.templates = lib.genAttrs' identities (
+      key:
+      lib.nameValuePair (emailTemplate key) {
+        content = ''
           [user]
-              email = ${config.sops.placeholder."email/personal"}
+            email = ${config.sops.placeholder."email/${key}"}
         '';
-          ".gitconfig.work.email".content = ''
-            [user]
-              email = ${config.sops.placeholder."email/work"}
-          '';
-        };
-      };
       }
-    // {
+    );
+
     warnings = lib.optional (
       !config.nvim.enable
     ) "'git.enable' is enabled without 'nvim.enable' (not using 'nvimdiff')";
@@ -162,8 +154,11 @@ in
         })
       ];
 
-        includes = [
-          { path = personalEmail; }
+      includes =
+        lib.optional (config.secrets.templatePath ? ${emailTemplate "personal"}) {
+          path = config.secrets.templatePath.${emailTemplate "personal"};
+        }
+        ++ [
           {
             condition = "gitdir:~/work/";
             contents = workSettings;
@@ -176,6 +171,5 @@ in
           }
         ];
     };
-    }
-  );
+  };
 }

home/modules/secrets/default.nix

@@ -2,24 +2,108 @@
   config,
   lib,
   pkgs,
+  inputs,
+  lib',
+  osConfig ? null,
   ...
 }:
+
+let
+  cfg = config.secrets;
+  sops = lib'.sopsAvailability config osConfig;
+  standalone = !sops.osAvailable;
+
+  sopsDir = "${toString inputs.nix-secrets}/secrets";
+in
 {
+  imports = [ ./vault.nix ];
+
   options.secrets = {
     enable = lib.mkEnableOption "secrets";
 
     vault = {
       enable = lib.mkEnableOption "vault CLI";
     };
+
+    files = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+      default = { };
+      example = {
+        taskwarrior = [ "sync-server-url" ];
+      };
+      description = "Keys to decrypt, grouped by the sops file that holds them.";
     };
 
-  imports = [ ./vault.nix ];
+    templates = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            path = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "Where to render the template, relative to the home directory.";
+            };
+            content = lib.mkOption {
+              type = lib.types.str;
+              description = "Template body; interpolate keys with `config.sops.placeholder`.";
+            };
+          };
+        }
+      );
+      default = { };
+      description = "Secret-bearing templates to render; declare their keys in `secrets.files`.";
+    };
 
-  config = lib.mkIf config.secrets.enable {
-    home.packages = with pkgs; [
-      age
-      age-plugin-yubikey
-      sops
+    path = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      readOnly = true;
+      description = "Decrypted secret paths, keyed by `<file>/<key>`.";
+    };
+
+    templatePath = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      readOnly = true;
+      description = "Rendered template paths, keyed by template name.";
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      secrets.path = lib.optionalAttrs sops.available (
+        lib.mapAttrs (_: secret: secret.path) sops.secrets
+      );
+
+      secrets.templatePath = lib.optionalAttrs sops.available (
+        lib.mapAttrs (_: template: template.path) sops.templates
+      );
+    }
+    (lib.mkIf cfg.enable (
+      lib.optionalAttrs standalone {
+        sops = {
+          secrets = lib'.mkSopsSecrets sopsDir null cfg.files;
+
+          templates = lib.mapAttrs (
+            _: t:
+            {
+              inherit (t) content;
+            }
+            // lib.optionalAttrs (t.path != null) {
+              path = "${config.home.homeDirectory}/${t.path}";
+            }
+          ) cfg.templates;
+        };
+      }
+      // {
+        home.packages = [
+          pkgs.age
+          pkgs.age-plugin-yubikey
+          pkgs.sops
+        ];
+
+        warnings = lib.optional (
+          !sops.available && (cfg.files != { } || cfg.templates != { })
+        ) "secrets are declared, but sops is unavailable; they will not be decrypted or rendered.";
+      }
+    ))
   ];
-  };
 }

home/modules/taskwarrior/default.nix

@@ -2,15 +2,11 @@
   config,
   lib,
   pkgs,
-  lib',
-  osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
-  sops = lib'.sopsAvailability config osConfig;
-  standalone = osConfig == null;
+  syncReady = config.secrets.templatePath ? "taskrc.d/sync";
 
   syncHook = pkgs.writers.writePython3 "on-exit.sync.py" { flakeIgnore = [ "E501" ]; } ''
     # Source: <https://gist.github.com/danmou/83079feac22307813178d7f8c456c544>
@@ -61,30 +57,22 @@ in
 {
   options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
 
-  config = lib.mkIf config.taskwarrior.enable (
-    lib.optionalAttrs standalone {
-      sops = {
-        secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-          taskwarrior = [
+  config = lib.mkIf config.taskwarrior.enable {
+    secrets.files.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"
       "sync-encryption-secret"
     ];
-        };
 
-        templates."taskrc.d/sync" = {
-          content = ''
+    secrets.templates."taskrc.d/sync".content = ''
       sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
       sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
       sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
     '';
-        };
-      };
-    }
-    // {
+
     warnings =
-        lib.optional (!sops.available)
-          "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
+      lib.optional (!syncReady)
+        "taskwarrior is enabled but its sync template is unavailable. taskwarrior sync will not be configured.";
 
     home.file = {
       ".local/share/task/hooks/on-exit.sync.py".source = syncHook;
@@ -162,10 +150,9 @@ in
         "recurrence" = "off";
         "reserved.lines" = "3";
       };
-        extraConfig = lib.optionalString sops.available ''
-          include ${sops.templates."taskrc.d/sync".path}
+      extraConfig = lib.optionalString syncReady ''
+        include ${config.secrets.templatePath."taskrc.d/sync"}
       '';
     };
-    }
-  );
+  };
 }

lib/secrets.nix

@@ -28,6 +28,7 @@
     in
     {
       available = osSopsAvailable || hmSopsAvailable;
+      osAvailable = osSopsAvailable;
       secrets = if osSopsAvailable then osConfig.sops.secrets else config.sops.secrets;
       templates = if osSopsAvailable then osConfig.sops.templates else config.sops.templates;
     };

modules/git/default.nix

@@ -9,21 +9,15 @@ in
   options.git.enable = lib.mkEnableOption "git";
 
   config = lib.mkIf cfg.enable {
-    sops.templates = {
-      ".gitconfig.email" = {
+    sops.templates = lib.genAttrs' [ "personal" "work" ] (
+      key:
+      lib.nameValuePair ".gitconfig.${key}.email" {
         inherit owner;
         content = ''
           [user]
-            email = ${config.sops.placeholder."email/personal"}
+            email = ${config.sops.placeholder."email/${key}"}
         '';
-      };
-      ".gitconfig.work.email" = {
-        inherit owner;
-        content = ''
-          [user]
-            email = ${config.sops.placeholder."email/work"}
-        '';
-      };
-    };
+      }
+    );
   };
 }