refactor: adopt modular secrets approach

modules/backups/default.nix

@@ -6,18 +6,19 @@
 
 let
   cfg = config.restic-backup;
+  inherit (config.secrets) sopsDir;
 in
 {
   options = {
     restic-backup = {
       repository = lib.mkOption {
         type = lib.types.str;
-        default = "b2:${config.sops.placeholder."b2_bucket_name"}:${config.networking.hostName}";
+        default = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
       };
 
       passwordFile = lib.mkOption {
         type = lib.types.str;
-        default = config.sops.secrets."restic_password".path;
+        default = config.sops.secrets.restic-password.path;
       };
 
       paths = lib.mkOption {
@@ -29,17 +30,30 @@ in
 
   config = {
     sops = {
-      secrets.b2_bucket_name = { };
-
-      templates."restic/repo-${config.networking.hostName}" = {
-        content = "b2:${config.sops.placeholder."b2_bucket_name"}:${config.networking.hostName}";
+      secrets = {
+        restic-password = {
+          sopsFile = "${sopsDir}/restic-password";
+        };
+        b2-bucket-name = {
+          sopsFile = "${sopsDir}/b2-bucket-name";
+        };
+        b2-account-id = {
+          sopsFile = "${sopsDir}/b2-account-id";
+        };
+        b2-account-key = {
+          sopsFile = "${sopsDir}/b2-account-key";
+        };
       };
-
-      templates."restic/b2-env-${config.networking.hostName}" = {
-        content = ''
-          B2_ACCOUNT_ID=${config.sops.placeholder."b2_account_id"}
-          B2_ACCOUNT_KEY=${config.sops.placeholder."b2_account_key"}
-        '';
+      templates = {
+        "restic/repo-${config.networking.hostName}" = {
+          content = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
+        };
+        "restic/b2-env-${config.networking.hostName}" = {
+          content = ''
+            B2_ACCOUNT_ID=${config.sops.placeholder.b2-account-id}
+            B2_ACCOUNT_KEY=${config.sops.placeholder.b2-account-key}
+          '';
+        };
       };
     };
 

modules/common/default.nix

@@ -2,6 +2,7 @@
   inputs,
   outputs,
   dotsPath,
+  myUtils,
   config,
   ...
 }:
@@ -61,7 +62,12 @@ in
       useGlobalPkgs = true;
       useUserPackages = true;
       extraSpecialArgs = {
-        inherit inputs outputs dotsPath;
+        inherit
+          inputs
+          outputs
+          dotsPath
+          myUtils
+          ;
       };
     };
   };

modules/hcloud/default.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  config,
+  ...
+}:
+
+let
+  cfg = config.hcloud;
+  inherit (config.secrets) sopsDir;
+in
+{
+  options.hcloud = {
+    enable = lib.mkEnableOption "hcloud CLI configuration";
+    username = lib.mkOption {
+      type = lib.types.str;
+      description = "Username for hcloud CLI configuration";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    sops.secrets.hcloud-token = {
+      sopsFile = "${sopsDir}/hcloud-token";
+      owner = config.users.users.${cfg.username}.name;
+    };
+
+    sops.templates."hcloud/cli.toml" = {
+      owner = config.users.users.${cfg.username}.name;
+      path = "/home/${cfg.username}/.config/hcloud/cli.toml";
+      content = ''
+        active_context = "server"
+
+        [[contexts]]
+          name = "server"
+          token = "${config.sops.placeholder.hcloud-token}"
+      '';
+    };
+  };
+}

modules/secrets/default.nix

@@ -7,102 +7,100 @@
 
 let
   cfg = config.secrets;
-in
-{
-  options = {
-    secrets.username = lib.mkOption {
-      type = lib.types.str;
+  inherit (cfg) sopsDir;
+  owner = config.users.users.${cfg.username}.name;
+
+  mkSecret = name: {
+    ${name} = {
+      sopsFile = "${sopsDir}/${name}";
+      inherit owner;
     };
   };
+in
+{
+  imports = [ inputs.sops-nix.nixosModules.sops ];
+
+  options = {
+    secrets = {
+      username = lib.mkOption {
+        type = lib.types.str;
+      };
+
+      sopsDir = lib.mkOption {
+        type = lib.types.str;
+        default = "${toString inputs.nix-secrets}/secrets";
+      };
+
+      nixSigningKey = {
+        enable = lib.mkEnableOption "nix signing key configuration";
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "${config.host.name}-nix-signing-key";
+        };
+      };
+    };
+  };
+
   config = {
     sops = {
-      defaultSopsFile = "${builtins.toString inputs.nix-secrets}/secrets.yaml";
-      defaultSopsFormat = "yaml";
       age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";
 
-      secrets = {
-        "taskwarrior_sync_server_url".owner = config.users.users.${cfg.username}.name;
-        "taskwarrior_sync_server_client_id".owner = config.users.users.${cfg.username}.name;
-        "taskwarrior_sync_encryption_secret".owner = config.users.users.${cfg.username}.name;
-        "email_personal".owner = config.users.users.${cfg.username}.name;
-        "email_work".owner = config.users.users.${cfg.username}.name;
-        "anki_sync_user".owner = config.users.users.${cfg.username}.name;
-        "anki_sync_key".owner = config.users.users.${cfg.username}.name;
-        "hcloud".owner = config.users.users.${cfg.username}.name;
-        "nix_signing_key_astyanax" = { };
-        "nix_signing_key_andromache" = { };
-        "opencode_api_key".owner = config.users.users.${cfg.username}.name;
-        # TODO: using shared secrets for now, but would be better to to per-host secrets
-        # To add per-host secrets:
-        # "restic_password_${config.networking.hostName}" = { };
-        # "restic_b2_account_id_${config.networking.hostName}" = { };
-        # "restic_b2_account_key_${config.networking.hostName}" = { };
-        "restic_password" = { };
-        "b2_bucket_name" = { };
-        "b2_account_id" = { };
-        "b2_account_key" = { };
-      };
+      secrets = lib.mkMerge [
+        (mkSecret "taskwarrior-sync-server-url")
+        (mkSecret "taskwarrior-sync-server-client-id")
+        (mkSecret "taskwarrior-sync-encryption-secret")
+        (mkSecret "anki-sync-user")
+        (mkSecret "anki-sync-key")
+        (mkSecret "email-personal")
+        (mkSecret "email-work")
+        (mkSecret "opencode-api-key")
+        (lib.mkIf cfg.nixSigningKey.enable (mkSecret cfg.nixSigningKey.name))
+      ];
 
       templates = {
         "taskrc.d/sync" = {
-          owner = config.users.users.${cfg.username}.name;
+          inherit owner;
           content = ''
-            sync.server.url=${config.sops.placeholder."taskwarrior_sync_server_url"}
-            sync.server.client_id=${config.sops.placeholder."taskwarrior_sync_server_client_id"}
-            sync.encryption_secret=${config.sops.placeholder."taskwarrior_sync_encryption_secret"}
+            sync.server.url=${config.sops.placeholder.taskwarrior-sync-server-url}
+            sync.server.client_id=${config.sops.placeholder.taskwarrior-sync-server-client-id}
+            sync.encryption_secret=${config.sops.placeholder.taskwarrior-sync-encryption-secret}
           '';
         };
 
         ".gitconfig.email" = {
-          owner = config.users.users.${cfg.username}.name;
+          inherit owner;
           path = "/home/${cfg.username}/.gitconfig.email";
           content = ''
             [user]
-              email = ${config.sops.placeholder."email_personal"}
+              email = ${config.sops.placeholder.email-personal}
           '';
         };
-
         ".gitconfig.work.email" = {
-          owner = config.users.users.${cfg.username}.name;
+          inherit owner;
           path = "/home/${cfg.username}/.gitconfig.work.email";
           content = ''
             [user]
-              email = ${config.sops.placeholder."email_work"}
-          '';
-        };
-
-        "hcloud/cli.toml" = {
-          owner = config.users.users.${cfg.username}.name;
-          path = "/home/${cfg.username}/.config/hcloud/cli.toml";
-          content = ''
-            active_context = "server"
-
-            [[contexts]]
-              name = "server"
-              token = "${config.sops.placeholder."hcloud"}"
+              email = ${config.sops.placeholder.email-work}
           '';
         };
 
         "opencode/auth.json" = {
-          owner = config.users.users.${cfg.username}.name;
+          inherit owner;
           path = "/home/${cfg.username}/.local/share/opencode/auth.json";
           content = ''
             {
               "zai-coding-plan": {
                 "type": "api",
-                "key": "${config.sops.placeholder."opencode_api_key"}"
+                "key": "${config.sops.placeholder.opencode-api-key}"
               }
             }
           '';
         };
-
-        "restic/b2-env" = {
-          content = ''
-            B2_ACCOUNT_ID=${config.sops.placeholder."b2_account_id"}
-            B2_ACCOUNT_KEY=${config.sops.placeholder."b2_account_key"}
-          '';
-        };
       };
     };
+
+    nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
+      config.sops.secrets.${cfg.nixSigningKey.name}.path
+    ];
   };
 }