refactor(secrets): simplify secrets

modules/secrets/default.nix

@@ -11,50 +11,58 @@ let
   cfg = config.secrets;
   inherit (cfg) sopsDir;
   owner = config.users.users.${cfg.username}.name;
-  mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options = {
-    secrets = {
-      username = lib.mkOption {
-        type = lib.types.str;
-      };
+  options.secrets = {
+    username = lib.mkOption {
+      type = lib.types.str;
+    };
 
-      sopsDir = lib.mkOption {
-        type = lib.types.str;
-        default = "${toString inputs.nix-secrets}/secrets";
-      };
+    sopsDir = lib.mkOption {
+      type = lib.types.str;
+      default = "${toString inputs.nix-secrets}/secrets";
+    };
 
-      nixSigningKey = {
-        enable = lib.mkEnableOption "nix signing key configuration";
-      };
+    groups = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+      default = { };
+      description = "Declarative secret groups: { group = [ key names ]; }";
+    };
 
-      yubikey = {
-        enable = lib.mkEnableOption "set up Yubikey";
-      };
+    owner = lib.mkOption {
+      type = lib.types.unspecified;
+    };
+
+    nixSigningKey = {
+      enable = lib.mkEnableOption "nix signing key configuration";
+    };
+
+    yubikey = {
+      enable = lib.mkEnableOption "set up Yubikey";
     };
   };
 
   config = {
+    secrets = {
+      inherit owner;
+      groups = {
+        email = [
+          "personal"
+          "work"
+        ];
+        nix = lib.optional cfg.nixSigningKey.enable "signing-key";
+      };
+    };
+
     sops = {
       # for yubikey, generate as follows:
       # ```
       # age-plugin-yubikey --identity > <keyfile-path>
       # ```
       age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";
-
-      secrets = lib.mkMerge [
-        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
-        (lib.mkIf cfg.nixSigningKey.enable {
-          nix-signing-key = {
-            sopsFile = "${sopsDir}/nix.yaml";
-            key = "signing-key";
-            inherit owner;
-          };
-        })
-      ];
+      secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [