From 631ad0d146b5992bd8bc46dd51c26d0b063774a9 Mon Sep 17 00:00:00 2001
From: hektor <hektor.misplon@pm.me>
Date: Sat, 11 Apr 2026 20:48:47 +0200
Subject: [PATCH] wip: secrets

---
 home/modules/anki/default.nix        | 10 ++++-
 home/modules/taskwarrior/default.nix | 18 ++++++++
 hosts/andromache/default.nix         |  4 ++
 hosts/astyanax/default.nix           |  4 ++
 hosts/vm/default.nix                 | 16 ++++---
 modules/ai-tools/default.nix         | 24 ++++++++++
 modules/anki/default.nix             | 11 +++++
 modules/backups/default.nix          | 29 +++++--------
 modules/git/default.nix              | 29 +++++++++++++
 modules/hcloud/default.nix           |  6 +--
 modules/secrets/default.nix          | 65 +++-------------------------
 modules/taskwarrior/default.nix      | 24 ++++++++++
 utils/default.nix                    | 24 ++++++++--
 13 files changed, 172 insertions(+), 92 deletions(-)
 create mode 100644 modules/ai-tools/default.nix
 create mode 100644 modules/anki/default.nix
 create mode 100644 modules/git/default.nix
 create mode 100644 modules/taskwarrior/default.nix

diff --git a/home/modules/anki/default.nix b/home/modules/anki/default.nix
index 337679fa..c2af3f3f 100644
--- a/home/modules/anki/default.nix
+++ b/home/modules/anki/default.nix
@@ -4,13 +4,19 @@
   pkgs,
   myUtils,
   osConfig ? null,
+  inputs ? null,
   ...
 }:
 
 let
   sops = myUtils.sopsAvailability config osConfig;
+  standalone = osConfig == null;
 in
 {
+  sops.secrets = lib.mkIf standalone (
+    myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [ "sync-user" "sync-key" ] { }
+  );
+
   warnings = lib.optional (
     !sops.available && config.programs.anki.enable
   ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
@@ -24,8 +30,8 @@ in
       review-heatmap
     ];
     profiles."User 1".sync = lib.mkIf sops.available {
-      usernameFile = "${sops.secrets."anki-sync-user".path}";
-      keyFile = "${sops.secrets."anki-sync-key".path}";
+      usernameFile = "${sops.secrets."anki/sync-user".path}";
+      keyFile = "${sops.secrets."anki/sync-key".path}";
     };
   };
 }
diff --git a/home/modules/taskwarrior/default.nix b/home/modules/taskwarrior/default.nix
index 0ec05d6a..ab459f63 100644
--- a/home/modules/taskwarrior/default.nix
+++ b/home/modules/taskwarrior/default.nix
@@ -5,13 +5,31 @@
   dotsPath,
   myUtils,
   osConfig ? null,
+  inputs ? null,
   ...
 }:
 
 let
   sops = myUtils.sopsAvailability config osConfig;
+  standalone = osConfig == null;
 in
 {
+  sops = lib.mkIf standalone {
+    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "taskwarrior" [
+      "sync-server-url"
+      "sync-server-client-id"
+      "sync-encryption-secret"
+    ] { };
+
+    templates."taskrc.d/sync" = {
+      content = ''
+        sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+        sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+        sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+      '';
+    };
+  };
+
   warnings =
     lib.optional (!sops.available && config.programs.taskwarrior.enable)
       "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix
index 1a915ab4..9179d75f 100644
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -23,6 +23,7 @@ in
       inherit lib config;
       device = "/dev/nvme1n1";
     })
+    ../../modules/anki
     ../../modules/audio
     ../../modules/backups
     ../../modules/bluetooth
@@ -31,17 +32,20 @@ in
     ../../modules/firewall
     ../../modules/fonts
     ../../modules/gaming
+    ../../modules/git
     ../../modules/hcloud
     ../../modules/keyboard
     ../../modules/localization
     ../../modules/networking
     ../../modules/nvidia
+    ../../modules/ai-tools
     (import ../../modules/secrets { inherit lib inputs config; })
     ../../modules/ssh
     ../../modules/storage
     ../../modules/stylix
     ../../modules/syncthing
     ../../modules/tailscale
+    ../../modules/taskwarrior
     ../../modules/users
     ../../modules/wol
     ../../modules/yubikey
diff --git a/hosts/astyanax/default.nix b/hosts/astyanax/default.nix
index b8abb1fa..2dfbd345 100644
--- a/hosts/astyanax/default.nix
+++ b/hosts/astyanax/default.nix
@@ -23,11 +23,14 @@ in
       device = "/dev/nvme0n1";
     })
     ../../modules/desktops/niri
+    ../../modules/anki
     ../../modules/audio
     ../../modules/backups
     ../../modules/bluetooth
+    ../../modules/git
     ../../modules/keyboard
     ../../modules/networking
+    ../../modules/ai-tools
     ../../modules/users
     ../../modules/localization
     ../../modules/fonts
@@ -38,6 +41,7 @@ in
     ../../modules/docker
     ../../modules/nfc
     ../../modules/firewall
+    ../../modules/taskwarrior
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/astyanax {
diff --git a/hosts/vm/default.nix b/hosts/vm/default.nix
index 224b278f..5075620b 100644
--- a/hosts/vm/default.nix
+++ b/hosts/vm/default.nix
@@ -12,20 +12,24 @@
     ./host.nix
     ./disk.nix
     ../../modules/common
-    ../../modules/boot/bootloader.nix
-    ../../modules/keyboard
-    ../../modules/networking
-    ../../modules/users
+    ../../modules/anki
     ../../modules/audio
-    ../../modules/localization
-    ../../modules/x
+    ../../modules/boot/bootloader.nix
     ../../modules/fonts
+    ../../modules/git
+    ../../modules/keyboard
+    ../../modules/localization
+    ../../modules/networking
+    ../../modules/ai-tools
     ../../modules/ssh
     ../../modules/storage
     ../../modules/stylix
     (import ../../modules/secrets {
       inherit lib inputs config;
     })
+    ../../modules/taskwarrior
+    ../../modules/users
+    ../../modules/x
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/vm {
diff --git a/modules/ai-tools/default.nix b/modules/ai-tools/default.nix
new file mode 100644
index 00000000..bf3121e5
--- /dev/null
+++ b/modules/ai-tools/default.nix
@@ -0,0 +1,24 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "opencode" [ "api-key" ] { inherit owner; };
+
+    templates."opencode/auth.json" = {
+      inherit owner;
+      path = "/home/${username}/.local/share/opencode/auth.json";
+      content = ''
+        {
+          "zai-coding-plan": {
+            "type": "api",
+            "key": "${config.sops.placeholder."opencode/api-key"}"
+          }
+        }
+      '';
+    };
+  };
+}
diff --git a/modules/anki/default.nix b/modules/anki/default.nix
new file mode 100644
index 00000000..2b516352
--- /dev/null
+++ b/modules/anki/default.nix
@@ -0,0 +1,11 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "anki" [ "sync-user" "sync-key" ] { inherit owner; };
+  };
+}
diff --git a/modules/backups/default.nix b/modules/backups/default.nix
index 8e934baf..b1ffbdba 100644
--- a/modules/backups/default.nix
+++ b/modules/backups/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   config,
+  myUtils,
   ...
 }:
 
@@ -13,12 +14,12 @@ in
     restic-backup = {
       repository = lib.mkOption {
         type = lib.types.str;
-        default = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
+        default = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
       };
 
       passwordFile = lib.mkOption {
         type = lib.types.str;
-        default = config.sops.secrets.restic-password.path;
+        default = config.sops.secrets."restic/password".path;
       };
 
       paths = lib.mkOption {
@@ -30,28 +31,18 @@ in
 
   config = {
     sops = {
-      secrets = {
-        restic-password = {
-          sopsFile = "${sopsDir}/restic-password";
-        };
-        b2-bucket-name = {
-          sopsFile = "${sopsDir}/b2-bucket-name";
-        };
-        b2-account-id = {
-          sopsFile = "${sopsDir}/b2-account-id";
-        };
-        b2-account-key = {
-          sopsFile = "${sopsDir}/b2-account-key";
-        };
-      };
+      secrets = lib.mkMerge [
+        (myUtils.mkSopsSecrets sopsDir "restic" [ "password" ] { })
+        (myUtils.mkSopsSecrets sopsDir "backblaze-b2" [ "bucket-name" "account-id" "account-key" ] { })
+      ];
       templates = {
         "restic/repo-${config.networking.hostName}" = {
-          content = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
+          content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
         };
         "restic/b2-env-${config.networking.hostName}" = {
           content = ''
-            B2_ACCOUNT_ID=${config.sops.placeholder.b2-account-id}
-            B2_ACCOUNT_KEY=${config.sops.placeholder.b2-account-key}
+            B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"}
+            B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"}
           '';
         };
       };
diff --git a/modules/git/default.nix b/modules/git/default.nix
new file mode 100644
index 00000000..1557b375
--- /dev/null
+++ b/modules/git/default.nix
@@ -0,0 +1,29 @@
+{
+  config,
+  ...
+}:
+
+let
+  inherit (config.secrets) username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops.templates = {
+    ".gitconfig.email" = {
+      inherit owner;
+      path = "/home/${username}/.gitconfig.email";
+      content = ''
+        [user]
+          email = ${config.sops.placeholder."email/personal"}
+      '';
+    };
+    ".gitconfig.work.email" = {
+      inherit owner;
+      path = "/home/${username}/.gitconfig.work.email";
+      content = ''
+        [user]
+          email = ${config.sops.placeholder."email/work"}
+      '';
+    };
+  };
+}
diff --git a/modules/hcloud/default.nix b/modules/hcloud/default.nix
index 7a7df657..a9591f2f 100644
--- a/modules/hcloud/default.nix
+++ b/modules/hcloud/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   config,
+  myUtils,
   ...
 }:
 
@@ -18,8 +19,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    sops.secrets.hcloud-token = {
-      sopsFile = "${sopsDir}/hcloud-token";
+    sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] {
       owner = config.users.users.${cfg.username}.name;
     };
 
@@ -31,7 +31,7 @@ in
 
         [[contexts]]
           name = "server"
-          token = "${config.sops.placeholder.hcloud-token}"
+          token = "${config.sops.placeholder."hcloud/api-token"}"
       '';
     };
   };
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
index 1ef1897c..7c733e77 100644
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -2,6 +2,7 @@
   lib,
   inputs,
   config,
+  myUtils,
   ...
 }:
 
@@ -9,13 +10,7 @@ let
   cfg = config.secrets;
   inherit (cfg) sopsDir;
   owner = config.users.users.${cfg.username}.name;
-
-  mkSecret = name: {
-    ${name} = {
-      sopsFile = "${sopsDir}/${name}";
-      inherit owner;
-    };
-  };
+  mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
@@ -46,61 +41,15 @@ in
       age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";
 
       secrets = lib.mkMerge [
-        (mkSecret "taskwarrior-sync-server-url")
-        (mkSecret "taskwarrior-sync-server-client-id")
-        (mkSecret "taskwarrior-sync-encryption-secret")
-        (mkSecret "anki-sync-user")
-        (mkSecret "anki-sync-key")
-        (mkSecret "email-personal")
-        (mkSecret "email-work")
-        (mkSecret "opencode-api-key")
-        (lib.mkIf cfg.nixSigningKey.enable (mkSecret cfg.nixSigningKey.name))
+        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
+        (lib.mkIf cfg.nixSigningKey.enable (
+          mkSopsSecrets cfg.nixSigningKey.name [ cfg.nixSigningKey.name ] { inherit owner; }
+        ))
       ];
-
-      templates = {
-        "taskrc.d/sync" = {
-          inherit owner;
-          content = ''
-            sync.server.url=${config.sops.placeholder.taskwarrior-sync-server-url}
-            sync.server.client_id=${config.sops.placeholder.taskwarrior-sync-server-client-id}
-            sync.encryption_secret=${config.sops.placeholder.taskwarrior-sync-encryption-secret}
-          '';
-        };
-
-        ".gitconfig.email" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.gitconfig.email";
-          content = ''
-            [user]
-              email = ${config.sops.placeholder.email-personal}
-          '';
-        };
-        ".gitconfig.work.email" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.gitconfig.work.email";
-          content = ''
-            [user]
-              email = ${config.sops.placeholder.email-work}
-          '';
-        };
-
-        "opencode/auth.json" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.local/share/opencode/auth.json";
-          content = ''
-            {
-              "zai-coding-plan": {
-                "type": "api",
-                "key": "${config.sops.placeholder.opencode-api-key}"
-              }
-            }
-          '';
-        };
-      };
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
-      config.sops.secrets.${cfg.nixSigningKey.name}.path
+      config.sops.secrets."${cfg.nixSigningKey.name}/${cfg.nixSigningKey.name}".path
     ];
   };
 }
diff --git a/modules/taskwarrior/default.nix b/modules/taskwarrior/default.nix
new file mode 100644
index 00000000..7be02621
--- /dev/null
+++ b/modules/taskwarrior/default.nix
@@ -0,0 +1,24 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "taskwarrior" [
+      "sync-server-url"
+      "sync-server-client-id"
+      "sync-encryption-secret"
+    ] { inherit owner; };
+
+    templates."taskrc.d/sync" = {
+      inherit owner;
+      content = ''
+        sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+        sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+        sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+      '';
+    };
+  };
+}
diff --git a/utils/default.nix b/utils/default.nix
index a8a091d5..9209d915 100644
--- a/utils/default.nix
+++ b/utils/default.nix
@@ -11,15 +11,31 @@
     else
       throw "meta.nix required in ${hostDir}";
 
+  mkSopsSecrets =
+    sopsDir: group: names: extraOpts:
+    let
+      file = "${group}.yaml";
+    in
+    lib.foldl' lib.mergeAttrs { } (
+      map (name: {
+        "${group}/${name}" = {
+          sopsFile = "${sopsDir}/${file}";
+          key = name;
+        }
+        // extraOpts;
+      }) names
+    );
+
   sopsAvailability =
     config: osConfig:
     let
-      hmSopsAvailable = config ? sops && config.sops ? secrets;
       osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets;
+      hmSopsAvailable = config ? sops && config.sops ? secrets;
+      preferOs = osSopsAvailable;
     in
     {
-      available = hmSopsAvailable || osSopsAvailable;
-      secrets = if hmSopsAvailable then config.sops.secrets else osConfig.sops.secrets;
-      templates = if hmSopsAvailable then config.sops.templates else osConfig.sops.templates;
+      available = osSopsAvailable || hmSopsAvailable;
+      secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets;
+      templates = if preferOs then osConfig.sops.templates else config.sops.templates;
     };
 }