fix(secrets): add enable option

home/hosts/andromache/default.nix

@@ -64,6 +64,7 @@
   };
   anki.enable = true;
   k8s.k9s.enable = true;
+  secrets.enable = true;
   taskwarrior.enable = true;
   audio.enable = true;
   ssh.enable = true;

home/hosts/astyanax/default.nix

@@ -60,6 +60,7 @@
   };
   anki.enable = true;
   k8s.k9s.enable = true;
+  secrets.enable = true;
   taskwarrior.enable = true;
   secrets.enable = true;
   my.yubikey.enable = true;

home/hosts/work/default.nix

@@ -96,6 +96,7 @@
   my.stylix.enable = true;
   git.github.enable = true;
   git.gitlab.enable = true;
+  secrets.enable = true;
   secrets.vault.enable = true;
   bruno.enable = true;
   docker.enable = true;

home/modules/secrets/default.nix

@@ -1,13 +1,19 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
 {
   imports = [ ./vault.nix ];
 
-  home.packages = with pkgs; [
+  options.secrets.enable = lib.mkEnableOption "secrets";
-    age
+
-    age-plugin-yubikey # TODO: only needed when using Yubikey
+  config = lib.mkIf config.secrets.enable {
-    sops
+    home.packages = with pkgs; [
-  ];
+      age
+      age-plugin-yubikey
+      sops
+    ];
+  };
 }

modules/secrets/default.nix

@@ -18,6 +18,8 @@ in
 
   options = {
     secrets = {
+      enable = lib.mkEnableOption "secrets management";
+
       sopsDir = lib.mkOption {
         type = lib.types.str;
         default = "${toString inputs.nix-secrets}/secrets";
@@ -42,7 +44,7 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf cfg.enable {
     secrets = {
       inherit owner;
       groups = {
@@ -55,10 +57,6 @@ in
     };
 
     sops = {
-      # for yubikey, generate as follows:
-      # ```
-      # age-plugin-yubikey --identity > <keyfile-path>
-      # ```
       age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
       secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
     };
@@ -68,7 +66,7 @@ in
     ];
 
     services = {
-      pcscd.enable = true; # needed for age-plugin-yubikey?
+      pcscd.enable = true;
       udev.packages = lib.mkIf cfg.yubikey.enable [
         pkgs.yubikey-personalization
         pkgs.libfido2