feat: add 'secrets' module to work host

home/hosts/work/default.nix

@@ -28,6 +28,7 @@ in
     ../../modules/kitty.nix
     ../../modules/nvim.nix
     ../../modules/pandoc.nix
+    ../../modules/secrets
     ../../modules/browser
     ../../modules/shell
     ../../modules/music
@@ -99,6 +100,10 @@ in
   github.enable = true;
   gitlab.enable = true;
   pandoc.enable = true;
+  secrets = {
+    enable = true;
+    vault.enable = true;
+  };
 
   shell.bash.enable = true;
   starship.enable = true;

home/modules/secrets/default.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.secrets = {
+    enable = lib.mkEnableOption "secrets";
+  };
+
+  imports = [ ./vault.nix ];
+
+  config = lib.mkIf config.secrets.enable {
+    home.packages = with pkgs; [
+      sops
+      age
+    ];
+  };
+}

home/modules/secrets/vault.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  options.secrets.vault = {
+    enable = lib.mkEnableOption "vault CLI";
+  };
+
+  config = lib.mkIf config.secrets.vault.enable {
+    home.packages = with pkgs; [ vault-bin ];
+  };
+}